CERT24MAL-2026-17919 — Malicious code in ukraine69 (PyPI)Loading data…
CERT24Threat Observatory
Period

MAL-2026-17919 — Malicious code in ukraine69 (PyPI)

The ukraine69 package contains malicious code that runs on import. Versions 1.2.0–1.2.2 and 1.2.5–1.2.8 search for local .vault files and may attempt to delete a Telegram account when usable Telegram session fields are present. Version 1.2.3 instead performs local reconnaissance. Static analysis has not established actual account deletion, successful Hotaru modification, or victim execution.

← Back to intelligence

MAL-2026-17919 — Malicious code in ukraine69 (PyPI)

The ukraine69 package contains malicious code that runs on import. Versions 1.2.0–1.2.2 and 1.2.5–1.2.8 search for local .vault files and may attempt to delete a Telegram account when usable Telegram session fields are present. Version 1.2.3 instead performs local reconnaissance. Static analysis has not established actual account deletion, successful Hotaru modification, or victim execution.