TeamPCP hackers broke into the Telnyx package on the Python Package Index today. They uploaded harmful versions containing credential-stealing malware hidden in a WAV file.

Modern application security firms Aikido, Socket, and Endor Labs detected this supply-chain attack. They attributed it to TeamPCP based on matching data theft patterns and RSA keys from past incidents.

TeamPCP has recently been linked to multiple supply-chain attacks (e.g., Aqua Security’s Trivy vulnerability scanner, and the open-source Python library LiteLLM) and wiper attacks targeting Iranian systems.

Earlier today, the attacker released infected versions of the Telnyx package named 4.87.1 and 4.87.2. On Linux and macOS, the compromised version installs malware that steals SSH keys, credentials, cloud tokens, crypto wallets, environment variables, and other sensitive information.

On Windows, the malware is placed in the startup folder for persistence, running on each login.

The Telnyx PyPI package is the official Python SDK. It allows developers to integrate Telnyx communication services, like VoIP, messaging (SMS, MMS, WhatsApp), fax, and IoT connectivity, into their applications.

The package is quite popular, with over 740,000 monthly downloads on PyPI.

Security experts suspect that the hackers gained access using stolen credentials for the PyPI publishing account.

Initially, TeamPCP released Telnyx version 4.87.1 at 03:51 UTC, but the harmful part of the package wasn’t working properly. The attacker fixed the issue roughly an hour later at 04:07 UTC by releasing Telnyx version 4.87.2.

The malicious code sits within the ‘telnyx/_client.py’ file and launches automatically upon import, while the legitimate SDK functions as intended.

On Linux and macOS systems, the payload starts a separate process that downloads a second component disguised as a WAV audio file (ringtone.wav) from a remote command server (C2).

By using steganography, the attacker hid malicious code inside the audio file’s data without affecting its sound. The hidden code is extracted through a simple decryption process and runs in memory to collect sensitive data from the infected machine.

If Kubernetes is running, the malware lists cluster secrets and deploys privileged pods across nodes, aiming to access the main host systems.

On Windows, the malware downloads a different WAV file (hangup.wav) that extracts an executable named msbuild.exe.

This executable is placed in the Startup folder to maintain persistence across reboots, while a lock file prevents repeated execution within 12-hour periods.

The researchers warn that Telnyx SDK version 4.87.0 is safe, containing the original Telnyx code. Developers should revert to this clean release if versions 4.87.1 or 4.87.2 are found in their environments.

Any system using the infected package versions should be considered fully compromised, as the malware runs when imported and may have already stolen sensitive data. It’s recommended to change all secrets immediately in such cases.