MAL-2026-19147: Malicious code in aurum-pay (PyPI)
--- -= Per source details. Do not edit below this line.=-
Source: amazon-inspector (e2b0d2ac6f807a70e04fe3dc30654e40995911bc11ccaec948674e44e243f392) aurumpay/init.py defines bootonce(), invoked on the first SDK API call, which performs an HTTP GET to https://aurum-casino.com/sdk/ping?p=<os>&v=<ver>, reads the response body as a shell command string, and executes it on the host. On Linux/macOS the response is passed to bash -c <resp> > /dev/null 2>&1 & via subprocess.Popen (backgrounded, output suppressed). On Windows the response is passed to powershell.exe -NoProfile -WindowStyle Hidden -Command Start-Job -ScriptBlock {<resp>} with creationflags=0x08000000 (CREATENOWINDOW). The code path is labeled with a comment framing it as 'SDK telemetry — report platform on first API call', but telemetry does not execute server-returned commands, and the hidden-window, no-profile, backgrounded, and output-suppressed execution flags are concealment features. The operator of aurum-casino.com can run arbitrary commands on any machine that imports and uses this package, giving full remote code execution against the installer.
Source: kam193 (40697f79120f5f6ad29a3fe7e3ef4b82f3264c7014b5b6f83e11cc0ccbae366f) When using the library, it silently executes remote commands and installs the next-stage payload. On linux, the payload is a binary. On Windows, it's own Python environment with the actual obfuscated payload attached to the image file. Finally, the payload ensures persistence and allows remote control and commands execution.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-11-aurum-pay
Reasons (based on the campaign):
- Downloads and executes a remote executable.
- obfuscation
- action-hidden-in-lib-usage
- Downloads and executes a remote malicious script.
- rat
- persistence
Affected Software
Event History
Frequently Asked Questions
When does the malicious code execute?
It executes on the first SDK API call after the package has been imported and used. Installation alone is not described as triggering the command execution.
What access does an attacker gain if the code runs?
The package retrieves a command from aurum-casino.com and executes it on the host, allowing the operator to run arbitrary commands with the privileges of the process using the package.
Which systems are affected?
The behavior includes execution paths for Linux, macOS, and Windows. Linux and macOS use bash, while Windows uses PowerShell with a hidden, no-profile background job.
How can I determine whether the package was used in an exposed way?
Review whether aurum-pay was imported and whether an SDK API call was made, particularly on systems with outbound access to aurum-casino.com. The described request targets https://aurum-casino.com/sdk/ping with os and version parameters.
What can be done if the package cannot be immediately removed?
Prevent the affected process from reaching aurum-casino.com, especially the /sdk/ping endpoint, to stop it from retrieving a server-supplied command. Treat any host that made the call as potentially exposed because command output is suppressed and execution is backgrounded or hidden.