Stealthy ZiChatBot Malware Infiltrates Systems via Malicious PyPI Packages
Cybersecurity researchers have recently uncovered a sophisticated supply chain attack involving the Python Package Index (PyPI) repository. Three malicious packages—uuid32-utils, colorinal, and termncolor—were identified as carriers of a previously unknown malware family named ZiChatBot, targeting both Windows and Linux systems.
These packages, uploaded between July 16 and 22, 2025, appeared legitimate, offering functionalities as described on their PyPI pages. However, their primary intent was to covertly deliver malicious payloads. Notably, termncolor, while seemingly benign, listed colorinal as a dependency, further facilitating the malware’s spread.
Infection Mechanism:
– Windows Systems: Upon installation of uuid32-utils or colorinal, the malicious code extracts a DLL dropper named terminate.dll to the disk. When the library is imported into a project, this DLL is loaded, deploying ZiChatBot. The malware then establishes an auto-run entry in the Windows Registry and executes code to erase its traces from the host system.
– Linux Systems: The Linux variant involves a shared object dropper called terminate.so, which places the malware in the /tmp/obsHub/obs-check-update directory and sets up a crontab entry for persistence.
ZiChatBot distinguishes itself by utilizing the REST APIs of the public team chat application Zulip as its command-and-control (C2) infrastructure, deviating from traditional malware that relies on dedicated C2 servers. This method allows the malware to execute shellcode received from its C2 server. After executing a command, it sends a heart emoji back to the server, signaling successful operation.
Potential Attribution:
While the exact perpetrators remain unidentified, Kaspersky’s analysis reveals a 64% similarity between the dropper used in this campaign and one previously employed by OceanLotus (APT32), a Vietnam-aligned hacking group. In late 2024, OceanLotus was observed targeting the Chinese cybersecurity community with compromised Visual Studio Code projects masquerading as Cobalt Strike plugins. These projects delivered trojans that executed automatically upon compilation, using the Notion note-taking service as their C2 infrastructure.
If OceanLotus is indeed behind the ZiChatBot campaign, it signifies an expansion of their attack strategies, moving beyond traditional phishing emails to more complex supply chain attacks.
Broader Context:
This incident is part of a growing trend where malicious actors exploit open-source repositories to distribute malware. For instance, in January 2024, researchers identified malicious packages on PyPI delivering the WhiteSnake Stealer malware on Windows systems. Similarly, in December 2023, 116 malicious packages were found on PyPI, infecting systems with custom backdoors. These incidents underscore the critical need for developers to exercise caution when integrating third-party packages into their projects.
Recommendations for Developers:
1. Vigilant Package Selection: Scrutinize the authenticity of packages before integration. Verify the credibility of the package author and check for any red flags in the package’s description or codebase.
2. Regular Security Audits: Conduct periodic reviews of dependencies to identify and mitigate potential vulnerabilities.
3. Implement Security Tools: Utilize tools designed to detect and prevent the inclusion of malicious packages in your projects.
4. Stay Informed: Keep abreast of the latest cybersecurity threats and trends to proactively defend against emerging risks.
By adopting these practices, developers can enhance the security posture of their applications and protect end-users from potential threats.
