2026-11-protecteda / 2026-11-filipt: Malicious PyPI packages protecteda, ln9qw38745g, zyto ship infostealer and RAT payloads
Severity: critical · Patch status: no-fix-needed · Since 2026-11-04
Three malicious PyPI packages were published to the GitHub Advisory Database on 2026-11-04 as part of two related campaigns. protecteda 0.1.0 runs an embedded executable identified as an infostealer when started as a module. ln9qw38745g 0.1.0/0.1.1 and zyto 0.2.0-0.2.3 (campaign 2026-11-filipt) ship embedded executables flagged by AV vendors and override the install command in setup.py to execute malicious code during installation; the campaign is linked to a prior package that swapped a benign executable for a malicious RAT after a few releases. No patched versions exist — the packages are outright malware and should be removed. Anyone who installed any of these packages is at risk of credential and data theft or RAT compromise.
What to do
- Check environments and lockfiles for protecteda, ln9qw38745g and zyto and remove them immediately
- If installed, treat all credentials, tokens and browser data on affected machines as compromised — rotate secrets and reimage if possible
- Audit setup.py install hooks and CI builds for execution of embedded executables
- Block these packages in internal registries/proxies and monitor for related campaign names
Sources
All live incidents on Threat Watch
