MAL-2026-18582: Malicious code in zyto (PyPI)

--- -= Per source details. Do not edit below this line.=-

Source: kam193 (817f92245d406e764c42e8038b2ea559a6bd6deb1706b80e2699e0ab724111a2) The package ships an executable started during the building of a wheel/installation. It has been identified as malicious by some AV vendors, but primarily it is a preparation to embed a RAT as in another campaign's package.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-11-filipt

Reasons (based on the campaign):

- The package overrides the install command in setup.py to execute malicious code during installation.

- malware

- rat