MAL-2026-16130
Malicious code in aitextkit-py (PyPI)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: kam193 (b1a048ec587dcab5a71ed9423d105b4b972f646b93f790f62c10d394610b64bf) The package hides code downloading script, which then downloads and executes a heavily obfuscated final stage. The remote stages are hosted on a domain presenting a suspicious-looking corporate website. The downloaded code establishes persistence e.g. as "anymeetly-cameradriver" systemd service.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-09-aitextkit-py
Reasons (based on the campaign):
- obfuscation
- Downloads and executes a remote malicious script.
- persistence
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for aitextkit-py (pip). Pin to a known-safe version or switch to an alternative.