Critical Telnyx Python SDK Backdoor Steals Credentials on Windows, macOS, Linux

Key Takeaways

• A supply chain attack targeted the Telnyx Python SDK on PyPI, with malicious versions 4.87.1 and 4.87.2 distributed by the TeamPCP threat actor group.
• The backdoored packages were designed to steal credentials from developer systems running Windows, macOS, and Linux.
• The attack leveraged WAV file steganography to conceal a credential-stealing payload, making static analysis ineffective.
• PyPI has quarantined the malicious versions; users are urged to downgrade to version 4.87.0 or earlier and rotate credentials.

A sophisticated supply chain attack orchestrated by the threat actor group known as TeamPCP recently compromised the Telnyx Python SDK, a widely utilized cloud communications library available on PyPI. This incident involved the distribution of backdoored versions of the SDK, designed to exfiltrate sensitive credentials from developer environments across Windows, macOS, and Linux operating systems.

The attack, documented by Trend Micro analysts, marks a concerning escalation in TeamPCP’s campaign, occurring just three days after they successfully compromised the LiteLLM AI proxy package. This rapid succession of incidents suggests a well-resourced and agile adversary systematically targeting critical open-source libraries integral to AI and development workflows.

Attack Details and Modus Operandi

On March 27, 2026, two malicious versions of the Telnyx package, 4.87.1 and 4.87.2, were uploaded to the Python Package Index (PyPI). Notably, these releases lacked corresponding commits in the official GitHub repository, a tell-tale sign of tampering. The compromised packages were engineered to covertly harvest credentials from developer machines, making this one of the most extensive supply chain attacks impacting open-source developers this year.

Trend Micro researchers identified that the malicious code was injected directly into the telnyx/_client.py file. Crucially, the payload was activated at module scope, meaning that merely importing telnyx into a Python project was sufficient to trigger its execution without requiring any further user interaction.

PyPI swiftly responded, quarantining both malicious versions approximately 6.5 hours after their initial appearance on the platform at 10:13 UTC. The last confirmed secure release remains version 4.87.0.

Credential Exfiltration and Persistence

The impact of this compromise is severe. Any system that installed either of the affected versions (4.87.1 or 4.87.2) should be considered fully compromised. The embedded payload was designed to steal credentials and transmit them securely to an attacker-controlled command-and-control (C&C) server, utilizing a robust encryption scheme involving AES-256-CBC and RSA-4096.

Beyond its multi-platform reach, the attack presented an additional threat to Windows users. The malware incorporated a boot persistence mechanism, ensuring it would automatically restart and remain active after every system reboot. This was achieved by installing a disguised executable named msbuild.exe into the Windows Startup folder.

WAV Steganography: A New Tactic

A significant evolution in TeamPCP’s tactics observed in this attack is the use of WAV file steganography to conceal the credential-stealing payload. Unlike their previous LiteLLM attack, where the malicious code was directly embedded as a Base64 blob, the Telnyx variant dynamically downloaded the malware at runtime from a C&C server located at 83[.]142[.]209[.]203:8080.

The payload was cleverly hidden within structurally valid WAV audio files. This method allowed the malicious files to bypass common MIME-type checks and file extension filters, effectively obscuring the harvester logic from direct inspection of the package’s source code.

The process involved the decoded Base64 payload on Linux downloading the WAV file, then decoding and executing its hidden contents. The extraction mechanism utilized Python’s wave module to read raw audio frames. This data was then Base64-decoded and split: the initial 8 bytes served as an XOR key, while the remainder constituted the encrypted payload. Each byte was subsequently XORed against this rotating key to recover the cleartext harvester. This innovative approach rendered static analysis of the package largely ineffective, as the core credential-stealing logic was never present in the initial code distribution.

Further complicating detection, the malicious code was fragmented across three distinct locations within the _client.py file, making it more challenging to identify through casual visual inspection.

What You Should Do

• Immediately Downgrade: If you have installed Telnyx Python SDK versions 4.87.1 or 4.87.2, downgrade immediately to version 4.87.0 or an earlier known-clean version.
• Assume Compromise: Treat any system that installed the affected versions as fully compromised.
• Rotate Credentials: Rotate all credentials accessible from affected machines, including API keys, database credentials, and user passwords.
• Monitor Network Traffic: Look for unusual network activity, specifically unexpected WAV file downloads from non-media IP addresses over port 8080, and outbound HTTP requests containing the X-Filename: tpcp.tar.gz header.
• Inspect System Files: On Windows systems, check user Startup directories for any unexpected msbuild.exe files.
• Pin PyPI Dependencies: Implement strict dependency management by pinning all PyPI dependencies by hash to prevent unauthorized package alterations.
• Enhance CI/CD Monitoring: Actively monitor CI/CD pipelines for any anomalous audio file downloads or unexpected outbound network connections.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.