MAL-2025-6540 Malicious code in mainx (PyPI)

While described as educational package to simulate post-exploitation environment, the malware is active and once started, automatically attempts to exfiltrate sensitive data (credentials, cookies, etc.) and places a Discord implant. The remote target is hard coded in the code.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2025-06-mainx

Reasons (based on the campaign):

• obfuscation

• infostealer

• files-exfiltration

• exfiltration-credentials

• exfiltration-browser-data

• peristence-autorun

• The package contains code to detect if it is running in a sandbox environment.