TeamPCP Hides Telnyx Python Malware Inside WAV Files
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- TeamPCP published malicious versions 4.87.1 and 4.87.2 of the telnyx Python package to PyPI on March 27, 2026, between 03:51 UTC and 10:13 UTC, with the PyPI project now quarantined and Telnyx recommending users downgrade to 4.87.0.
- The malware conceals its payload via audio steganography — downloading "hangup.wav" from a C2 server on Windows to drop a persistent "msbuild.exe" in the Startup folder, and "ringtone.wav" on Linux/macOS for a self-destructing smash-and-grab data harvest with no persistence mechanism.
- Endor Labs researchers Kiran Raj and Rachana Misal said the PyPI publishing token was most likely swept up during TeamPCP's prior litellm compromise, which harvested environment variables, .env files, and shell histories from every system that imported the library.
- The malware exfiltrates stolen data as "tpcp.tar.gz" via HTTP POST to a C2 server at 83.142.209[.]203:8080, and includes a Kubernetes lateral movement component that abuses service account tokens to deploy privileged pods to every node.
- TeamPCP is now collaborating with LAPSUS$ and emerging ransomware group Vect to monetize harvested credentials through extortion and ransomware, per Endor Labs' Henrik Plate — a shift from pure supply chain disruption to weaponized follow-on attacks.
- Snyk noted the campaign deliberately targets tools with elevated pipeline access — container scanner Trivy, infrastructure scanner KICS, AI routing library litellm, and now telnyx — each designed to read credentials, configs, and environment variables by default.
Why it matters: TeamPCP has now compromised four widely trusted Python packages (Trivy, KICS, litellm, telnyx) — all tools with deep, by-design access to CI/CD credentials and secrets — and is partnering with LAPSUS$ and ransomware group Vect to convert that harvested data into extortion and ransomware operations, effectively turning a supply chain campaign into a credential franchise for downstream criminal groups.
