MAL-2026-899

    Dashboard / Malicious Package / MAL-2026-899

    MAL-2026-899

    Published: 14 Feb 2026Last Modified: 14 Feb 2026

    Summary: Malicious code in dzuseragents (PyPI)

    Details: Source: kam193 (f0be670ad8e17f42129943a744559ebb8818c581bc637c1469cf8553b7b8f8c9) The package downloads an executable and adds it to autostart. The downloaded application then periodically creates a screenshot and sends it to a Discord channel, as well as waits for further instructions Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-02-dzuseragents Reasons (based on the campaign): - Downloads and executes a remote executable. - peristence-autorun - spyware-like

    References: https://app.any.run/tasks/5005486d-d1a6-4bd8-9615-ffee3229d3cb, https://tria.ge/260214-k3mq7af12d, https://www.virustotal.com/gui/file/41029a95379625eeedc13c2e2a6ea9da8bcff2ed056296c8216ecf77831b99f4/detection, https://www.pylingual.io/view?identifier=769c0a3900aed0a3dd1bae3a8ab84a94ea353adbfea376d8d50a07957bc7b573, https://bad-packages.kam193.eu/pypi/package/dzuseragents

    Affected packages

    Package

    Name: dzuseragents

    Purl: pkg:pypi/dzuseragents

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.0.1
    0.0.2