Back Ground.News

OceanLotus Suspected of Using PyPI to Deliver ZiChatBot Malware

Ground.News • May 7, 2026

Cybersecurity researchers have discovered three packages on the Python Package Index (PyPI) repository that are designed to stealthily deliver a previously unknown malware family called ZiChatBot on Windows and Linux systems. "While these wheel packages do implement the features described on their PyPI web pages, their true purpose is to covertly deliver malicious files," Kaspersky

Open the article to view the coverage from Malware Analysis, News and Indicators

Open the article to view the coverage from securelist.com

To view factuality data please Upgrade to Premium

To view ownership data please Upgrade to Vantage

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

OceanLotus Campaign Distributes ZiChatBot Malware via PyPI Packages Beginning in July 2025, malicious wheel packages were uploaded to the Python Package Index (PyPI) by the OceanLotus group, delivering a new malware family named ZiChatBot. This malware targets both Windows and Linux systems, utilizing REST APIs from the Zulip chat app for command and control instead of traditional servers. The attack method involved creating benign-looking packages that included malicious dependencies, effectively concealing the malware. Kaspersky's Threat Attribution Engine linked these packages to OceanLotus, confirming the campaign as a supply chain attack. The malicious packages were removed from PyPI after detection, but the incident highlights the ongoing risks associated with software supply chains. Security professionals are urged to remain vigilant against similar threats. 10 sources 70

Extracted Entities

OceanLotus Suspected of Using PyPI to Deliver ZiChatBot Malware

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Domains (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (2)