MAL-2026-18633: Malicious code in extera-runtime (PyPI)
--- -= Per source details. Do not edit below this line.=-
Source: kam193 (400bf2ff64fec2a3d26fa477d19f25b0d2abfdc40ae5247531a128cfdc41aa19) The package provides functionality to exfiltrate sensitive Telegram files. The malicious code does not start automatically.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-11-extera-plugin-runtime
Reasons (based on the campaign):
- The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.
- files-exfiltration
- target:telegram
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this package's malicious behavior?
Users who install the package and then invoke the malicious functionality are exposed. The available information specifically identifies sensitive Telegram files as an exfiltration target.
Does the malicious code run automatically after installation?
No. The source states that the malicious code does not start automatically, so exploitation requires some additional action that triggers it.
What capabilities does the package include?
It contains functionality to exfiltrate sensitive Telegram files and code to execute remote commands on the victim machine. The remote-command capability may be limited to a specific set of commands.