MAL-2026-18625: Malicious code in extera-plugin-runtime (PyPI)
--- -= Per source details. Do not edit below this line.=-
Source: kam193 (b13320bcb71932e051e8e2a8fbd98f3e8faadae85f0ae60ca2f1c2cf8d827829) The package provides functionality to exfiltrate sensitive Telegram files. The malicious code does not start automatically.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-11-extera-plugin-runtime
Reasons (based on the campaign):
- The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.
- files-exfiltration
- target:telegram
Affected Software
Event History
Frequently Asked Questions
Does the malicious functionality run automatically after installation?
No. The available data states that the malicious code does not start automatically.
What data is the package designed to target?
It provides functionality to exfiltrate sensitive Telegram files.
What other attacker capability is present?
The package contains code intended to execute remote commands on the victim machine, apparently limited to a specific set of commands.