Malicious code in hello-bat-fwi9 (PyPI)
MAL-2026-18735
Published · Modified
Dependency scanning
Check whether hello-bat-fwi9 is in your codebase
Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.
Description
__
Source: kam193 (915b488501776e1dc1f9c551e0a52310fc6daa8a299b0638f6d5d7f615d1ad8b)
The package delivers an obfuscated .bat file delivering a RAT, with the help of its own Python runtime and PTH files. The code requires manually triggering the malicious action. This is most likely a continuation of the campaign 2026-11-filipt.
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-11-hello-bat-fwi9
Reasons (based on the campaign):
obfuscation
rat
abuses-pth
malware
Ready to move
Start Securing
Free, no credit card | First findings in minutes