MAL-2026-16131
Malicious code in aitextutils-py (PyPI)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: kam193 (079adf053b093075a5d8151dbbb82bb85a45f577ae3a9f6e6c751a4779d52f77) This package executes code from malicious dependency, which hides code downloading script, which then downloads and executes a heavily obfuscated final stage. The remote stages are hosted on a domain presenting a suspicious-looking corporate website. The downloaded code establishes persistence e.g. as "anymeetly-cameradriver" systemd service.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-09-aitextkit-py
Reasons (based on the campaign):
- obfuscation
- Downloads and executes a remote malicious script.
- persistence
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for aitextutils-py (pip). Pin to a known-safe version or switch to an alternative.