MAL-2026-11428 Malicious code in wacve-utils (PyPI)

On import wacve_utils, the package's __init__.py unconditionally invokes check_for_updates(), which HTTP-fetches a hardcoded GitHub Gist under the user Darknet-Hacker (gist.githubusercontent.com/Darknet-Hacker/7f7e01a86e68403a457c4cd0c2d93f1d/raw/), base64-decodes the body, XORs it with a key derived from the string wacve_utils, zlib-decompresses it, marshal.loads a Python code object, and execs it in-process. If the Gist fetch fails, the module falls back to shipped opaque blobs config-linux.dat / config-termux.dat (selected by a Termux/Linux platform branch) and runs them through the same base64+XOR+zlib+marshal decode-and-exec path. No pinning, no signature verification, and the payload is mutable by the Gist owner. The package advertises itself as Lightweight utilities for chat application security checks and exposes a stub check_vulnerability that returns a random boolean — a cover story unrelated to the executed payload. Importing this package grants the Gist owner arbitrary code execution in the installer's Python process.

The package contains encrypted code with infostealers targeting Linux and Android (execution under Termux). The encrypted code collects files, browsers data, text messages and exfiltrates them to a Telegram channel.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-08-wacve-utils

Reasons (based on the campaign):

• files-exfiltration

• exfiltration-browser-data

• uses-telegram-bot

• obfuscation

• Downloads and executes a remote malicious script.

• infostealer