📰 Malicious PyPI Packages Use Zulip Chat App for C2 to Deploy 'ZiChatBot' Malware

🚨 Malicious PyPI packages found delivering 'ZiChatBot' malware. The campaign, linked to the OceanLotus APT, uses the Zulip chat app's APIs for stealthy C2 communication. #SupplyChainAttack #PyPI #Malware #OceanLotus

🔗 https://cyber.netsecops.io

OceanLotus Exploits PyPI to Deliver ZiChatBot Malware

Kaspersky's analysis uncovered a sneaky malware attack on PyPI, where OceanLotus hackers uploaded fake packages that looked like harmless libraries, tricking users into installing the ZiChatBot malware. The malicious packages, uploaded in July 2025, masqueraded as legitimate tools like uuid32-utils, colorinal, and termncolor.

https://osintsights.com/oceanlotus-exploits-pypi-to-deliver-zichatbot-malware?utm_source=mastodon&utm_medium=social

#Oceanlotus #Pypi #ZichatbotMalware #MalwareOperations #EmergingThreats

via: @campuscodi

QiAnXin published a report on the recent attacks of #OceanLotus (#APT32) that targeted Chinese organizations throughout 2021.

The group allegedly used 3 zero-day #vulns:

+1 in an unnamed antivirus product
+2 in an unnamed workstation management system. More here (in Chinese): https://mp.weixin.qq.com/s/pd6fUs5TLdBtwUHauclDOQ | #infosec #espionage #malware