MAL-2026-11503 Malicious code in instalogin1234 (PyPI)
- Package
- instalogin1234
- Registry
- PyPI
What is MAL-2026-11503?
MAL-2026-11503 is a malicious package in instalogin1234, published on 3 Aug 2026.
Official description
The package presents itself as a 'Modern Instagram CLI' but its login command displays a fake Instagram login prompt that reads a username and password via input() and POSTs the concatenated credentials to a hardcoded Discord channel (channel id 1246456414843437101) using a hardcoded Discord bot authorization token embedded in shell.py. After exfiltration it opens https://instagram.com/ in the user's browser as cover so the interaction appears to succeed. The advertised purpose is a cover story for credential harvesting; the Discord channel and bot token are attacker-controlled.
The package promises to be an Instagram CLI and offers "login". Entered credentials are sent to a Discord channel, and the user is presented with the Instagram website just opened in the browser.
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-08-instalogin1234
Reasons (based on the campaign):
- exfiltration-credentials
What should I do about MAL-2026-11503?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.