PyPI Packages Deliver ZiChatBot Malware via Zulip APIs on Windows and Linux

Back Thehackernews

PyPI Packages Deliver ZiChatBot Malware via Zulip APIs on Windows and Linux

Thehackernews •[email protected] (The Hacker News) • May 7, 2026

Share: View original

Learn how to stop patient zero attacks before they bypass detection and compromise your systems at entry points.

Learn how to validate real attack paths and reduce exploitable risk with continuous agentic security validation.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

OceanLotus Campaign Distributes ZiChatBot Malware via PyPI Packages Beginning in July 2025, malicious wheel packages were uploaded to the Python Package Index (PyPI) by the OceanLotus group, delivering a new malware family named ZiChatBot. This malware targets both Windows and Linux systems, utilizing REST APIs from the Zulip chat app for command and control instead of traditional servers. The attack method involved creating benign-looking packages that included malicious dependencies, effectively concealing the malware. Kaspersky's Threat Attribution Engine linked these packages to OceanLotus, confirming the campaign as a supply chain attack. The malicious packages were removed from PyPI after detection, but the incident highlights the ongoing risks associated with software supply chains. Security professionals are urged to remain vigilant against similar threats. 10 sources 70

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

T1195 - Supply Chain Compromise

Platforms (2)