MAL-2026-10868 Malicious code in neroteam-v1 (PyPI)

Importing the nero package triggers nero/__init__.py to load nero.main, whose top-level code runs a _guard() routine before executing a hidden payload. _guard() performs anti-debug checks (sys.gettrace, sys.settrace(None), _getframe().f_trace), timing checks, and substring matching against sandbox/VM indicators (sandbox, virtualbox, vmware, qemu, wine, hyperv, xen) in PATH, the Python executable path, and processor identifiers. It then base64-decodes a ~110KB blob, decrypts it with a custom RC4-like keystream cipher keyed by the string Cxdgs, and passes the plaintext to exec(). The decrypted code is opaque and only reachable on machines that pass the anti-analysis gauntlet. The combination of import-time exec of a custom-encrypted blob with dedicated anti-VM and anti-debug evasion is inconsistent with the package's stated 'account generator' purpose and matches the shape of hostile install/import-time code execution against the installer's host.

Obfuscated code is used to abuse systems of garena[.]com for mass account generation, bypassing their security systems.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-07-neroteam-v1

Reasons (based on the campaign):

• obfuscation

• abusing-3rd-api

• The package contains code to detect if it is running in a sandbox environment.