MAL-2026-18735: Malicious code in hello-bat-fwi9 (PyPI)
--- -= Per source details. Do not edit below this line.=-
Source: kam193 (915b488501776e1dc1f9c551e0a52310fc6daa8a299b0638f6d5d7f615d1ad8b) The package delivers an obfuscated .bat file delivering a RAT, with the help of its own Python runtime and PTH files. The code requires manually triggering the malicious action. This is most likely a continuation of the campaign 2026-11-filipt.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-11-hello-bat-fwi9
Reasons (based on the campaign):
- obfuscation
- rat
- abuses-pth
- malware
Affected Software
Event History
Frequently Asked Questions
What must happen for the malicious behavior to run?
The malicious action requires manual triggering. Installing or obtaining the package alone is not described as sufficient to activate the payload.
What is delivered when the malicious action is triggered?
The package contains an obfuscated .bat file that delivers a remote access trojan (RAT). It uses its own Python runtime and PTH files as part of the delivery mechanism.
How can I identify a potentially affected environment?
Check whether the PyPI package hello-bat-fwi9 has been installed or is present in dependency, build, or artifact inventories. Also investigate for the package's obfuscated batch file, bundled Python runtime, and PTH files.