CERT24MAL-2026-17881 — Malicious code in py-sock2 (PyPI)Loading data…
CERT24Threat Observatory
Period

MAL-2026-17881 — Malicious code in py-sock2 (PyPI)

Importing py-sock2's agentaix module downloads a raw GitHub file to a temporary Python file and launches it without a visible console on Windows. The source describes a Windows remote file management client in the file's history that creates an HKCU Run entry, polls https://googleforum.pythonanywhere.com for commands, and supports file upload, download, deletion, and command execution. The remote file is mutable, and its contents at the time of a particular victim's import and actual execution on victim systems have not been established.

← Back to intelligence

MAL-2026-17881 — Malicious code in py-sock2 (PyPI)

Importing py-sock2's agentaix module downloads a raw GitHub file to a temporary Python file and launches it without a visible console on Windows. The source describes a Windows remote file management client in the file's history that creates an HKCU Run entry, polls https://googleforum.pythonanywhere.com for commands, and supports file upload, download, deletion, and command execution. The remote file is mutable, and its contents at the time of a particular victim's import and actual execution on victim systems have not been established.