MAL-2025-191709 Malicious code in cti-ctf-challenges (PyPI)

If the method from the module is called, it attempts to download a malicious code (identified as msf payload) and save it locally. In the analysed version, the code starting the malicious code was commented out.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2025-07-web3dummycti

Reasons (based on the campaign):

• The package contains code to create a reverse shell, allowing an attacker to execute any commands on the victim's machine.

• action-hidden-in-lib-usage

• Downloads and executes a remote malicious script.