A threat actor tracked as TeamPCP, previously associated with supply chain compromises involving Trivy, KICS, and litellm, has broadened its activity by embedding malicious code into the telnyx Python package. Two altered versions were published to PyPI on March 27, 2026, and were subsequently quarantined.
The Malicious Versions and Initial Discovery
Versions 4.87.1 and 4.87.2 of the telnyx package were identified as containing credential-harvesting logic concealed within a .WAV audio file — a steganographic delivery method previously observed in this group’s operations. Multiple security vendors, including Aikido, Endor Labs, JFrog, Ossprey Security, SafeDep, Socket, and StepSecurity, independently verified that the injected code resides in telnyx/_client.py, causing execution automatically upon package import. Users are strongly advised to downgrade to version 4.87.0 immediately.
A Multi-Stage, Cross-Platform Attack Chain
The malware is designed for cross-platform execution across Windows, Linux, and macOS environments, with platform-specific behavior.
On Windows systems, the malware downloads a file named hangup.wav from a command-and-control (C2) server. This file contains a concealed executable payload, which is extracted and written to the Startup folder as msbuild.exe, enabling persistence by executing at each user login.
On Linux and macOS, the malware retrieves ringtone.wav from the same infrastructure. Instead of persistence, the payload operates in a transient fashion: a credential-harvesting script is extracted and executed in memory within a temporary directory that is deleted after execution, minimizing forensic artifacts.
Researchers at Ossprey Security highlighted that the use of .WAV files for payload delivery is a deliberate evasion strategy. Unlike executable binaries or encoded payloads, audio files are less likely to trigger detection by network monitoring and endpoint security tools.
Analysis from OX Security indicates a progression from earlier litellm-related attacks. Rather than embedding payloads directly within the package, TeamPCP now retrieves XOR-obfuscated payloads dynamically from remote infrastructure and executes them at runtime.
Data Exfiltration and Infrastructure
The harvesting component collects a wide array of sensitive information, including environment variables, configuration files, shell history, cloud credentials, and CI/CD secrets. The collected data is compressed into an archive named tpcp.tar.gz and transmitted via HTTP POST to the IP address 83.142.209.203 over port 8080.
How TeamPCP Likely Obtained the PyPI Publishing Token
The precise mechanism used to obtain the telnyx PyPI publishing token has not been confirmed. However, researchers at Endor Labs assess that it was likely captured during the earlier litellm compromise. Because that attack harvested environment variables, .env files, and shell histories, any system containing both litellm and a configured telnyx publishing token could have unintentionally exposed credentials.
Telnyx confirmed that the compromised versions were removed from PyPI. Users who installed or upgraded the package between 03:51 UTC and 10:13 UTC on March 27, 2026 are advised to treat their environments as potentially compromised. The company continues to investigate the source of the credential exposure.
A Maturing and Expanding Threat Actor
This campaign differs from typical supply chain attacks due to its focus on legitimate, widely trusted tools that inherently operate with elevated privileges. Rather than relying on typosquatting, TeamPCP has consistently compromised established libraries, including a container security scanner (Trivy), an infrastructure-as-code analysis tool (KICS), an AI integration library (litellm), and now a communications SDK (telnyx). These tools naturally require access to sensitive data, making them highly effective vectors for credential harvesting.
The use of .WAV-based steganography is consistent with prior activity attributed to the group. This method was previously observed in the “kamikaze” wiper malware delivered via CanisterWorm and exposed Docker environments, which also incorporated Kubernetes lateral movement by abusing service account tokens to deploy privileged workloads.
Additionally, TeamPCP has reportedly formed alliances with other cybercriminal entities, including LAPSUS$ and a newer ransomware group known as Vect. The intent appears to be monetization of harvested credentials through extortion and ransomware deployment. Security researchers characterize this as a staged operational model, where initial access and data collection are separated from downstream exploitation.
This reflects a broader evolution in ransomware operations. Threat actors are increasingly shifting toward supply chain compromises — particularly targeting developer tools, CI/CD pipelines, and security software — as these systems inherently operate with elevated permissions and broad access.
Recommended Remediation Steps
Organizations utilizing the telnyx Python package should take the following measures:
- Audit all Python environments and dependency manifests for versions 4.87.1 or 4.87.2 and replace them with version 4.87.0 or earlier.
- Assume compromise of any affected systems and rotate all credentials, API keys, tokens, and secrets accessible within those environments.
- Inspect Windows systems for the presence of msbuild.exe in the Startup directory, which indicates persistence.
- Block outbound communication to the identified C2 endpoint at 83.142.209.203.
The telnyx incident highlights an increasingly critical risk: tools within development pipelines — including security scanners, build systems, and IDE extensions — operate with extensive system privileges by design. When these tools themselves are compromised, they become highly effective attack vectors, reinforcing the need to treat every pipeline component as part of the attack surface.