PyPI Packages Deliver ZiChatBot Malware via Zulip APIs on Windows and Linux

PyPI packages were exploited to deliver ZiChatBot malware through a supply chain attack on Windows and Linux systems.

• •Three packages (uuid32-utils, colorinal, termncolor) uploaded July 16-22, 2025, used Zulip REST APIs as C2 infrastructure
• •Windows version drops a DLL with auto-run registry persistence; Linux version plants code in /tmp with crontab entries
• •Malware executes shellcode and signals success with a heart emoji response
• •Kaspersky identified 64% similarity to OceanLotus dropper, indicating possible APT32 involvement

This summary was automatically generated by AI based on the original article and may not be fully accurate.