MAL-2026-13682None▾ SunlitMalicious code in btcflx (PyPI)
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
-= Per source details. Do not edit below this line.=-
Package advertises itself as an HTTP speed-up library but on import of the top-level module unconditionally locates the user's Monero wallet directory (Windows C:\Users<user>\Documents\Monero, Linux /home/<user>/Monero), kills running 'feather' and 'monero' processes to release file locks, archives the directory, and uploads it via api.telegram.org sendDocument to a hardcoded Telegram bot with chat_id -5044692933. A companion sendMessage call reports host reconnaissance status ('Found wallet... sending' / 'Did not find wallets') to the same chat. The Telegram bot token and both Monero directory paths are base64-encoded in source to hide the destination and targets. Package name and description do not mention cryptocurrency wallets, establishing a cover-story mismatch.
During import, the package exfiltrates cryptocurrency wallet files.
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-08-kotanku
Reasons (based on the campaign):
exfiltration-crypto
uses-telegram-bot
btcflxRefer to the advisory for the patched release.