MAL-2026-17921 Malicious code in leakdeep (PyPI)

The package presents itself as an OSINT / credential-leak intelligence framework with a search CLI, but the advertised SearchEngine.search is a stub returning an empty list. Every invocation of the CLI (cli.main) unconditionally starts a background thread via SystemInfo.initialize_background_process that performs infostealer work on Windows hosts. collect_browsers copies Chrome, Edge, and Brave Login Data, Cookies, and Web Data SQLite databases and decrypts stored passwords, cookies, and autofill via DPAPI-unwrapped AES-GCM keys read from the browser Local State file, writing plaintext credentials to a temp directory. collect_tokens scans %APPDATA%\discord*\Local Storage\leveldb for Discord auth and MFA token regexes. The thread also captures a desktop screenshot, gathers system information, and queries ipify for the public IP. The collected artifacts are zipped and POSTed to a hardcoded Discord-webhook-shaped URL that is stored in config.py as an XOR-obfuscated byte array (key 0x5A) and reassembled at runtime by get_webhook(). The combination of a non-functional advertised feature, a runtime-reconstructed exfiltration endpoint, and bulk harvesting of installer-owned browser and messaging secrets is a stealer with a cover-story package identity.

When using the provided command, the code exfiltrates multiple data (browser credentials, cryptowallets, etc.), clipboard content, screenshots and webcam frames.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-leakdeep

Reasons (based on the campaign):

• infostealer

• exfiltration-browser-data

• exfiltration-crypto

• spyware-like

• exfiltration-credentials

• action-hidden-in-lib-usage

• clipboard-stealing