This week, Tanium’s Cyber Threat Intelligence (CTI) team kicks off the roundup with a look at a sophisticated supply chain attack involving two malicious Python packages. Next, our team investigates PipeMagic, a modular backdoor framework disguised as a ChatGPT desktop app. Finally, we wrap up with an overview of Noodlophile Stealer, a rapidly evolving malware campaign.
Researchers discover malicious Python packages
Zscaler ThreatLabz uncovered a sophisticated supply chain attack involving the Python packages termncolor and colorinal, which deployed multi-stage malware delivered via AES-encrypted payloads using CBC mode and DLL injection.
The incident highlights the growing risk of malicious dependencies in open-source ecosystems and the need for vigilant package vetting.
Malicious package discovery
Zscaler found that termncolor imported an additional package called colorinal.
Zscaler states that termncolor “functions as a color utility for Python without displaying any malicious behavior.” Its inclusion of the colorinal dependency made it appear suspicious.
File investigation
Zscaler found a file called unicode.py within the colorinal package. Initially appearing to be a color utility script, it actually loads an embedded DLL (terminate.dll) to deploy the malware’s payload. The malware deletes both terminate.dll and unicode.py to hinder detection and analysis.
Here's how the attack progresses:
- First stage: The first stage is triggered when
terminate.dllis executed. One of the DLL’s main functions is to decrypt the embedded payload, storing this decrypted payload in the%LOCALAPPDATA%\vcpacketdirectory.
Zscaler notes that this location is also used as the staging area for additional next stage files, including two executables used later for DLL sideloading. The malware establishes persistence via registry creation and demonstrates cross-platform capability, with a variant specifically tailored for Linux. - Second stage: The second stage begins when a file called
libcef.dllis executed. According to Zscaler, this is “the primary malicious component dropped in the first stage.” This DLL helps the malware communicate with the command-and-control (C2) server. The malware is observed using the Zulip team messaging platform to disguise its activity as potentially legitimate communications. The malware sends collected data to the Zulip channel, then resolves APIs and executes shellcode retrieved from the threat actor.
The malware resolves the APIs with the help of a custom hashing method likely intended to obfuscate DLL and API names in low-level malware operations.
Analyst comments from Tanium’s Cyber Threat Intelligence team
This attack exemplifies the growing frequency and sophistication of supply chain threats, especially those that abuse trusted ecosystems like PyPI and other repositories.
Zscaler calls out techniques like legitimate binaries for DLL sideloading and encrypted payloads that can make detection more challenging and often require behavioral analysis and threat hunting beyond signature-based detections.
While the packages have since been removed from PyPI, these attacks serve as a reminder of just how critical it is to understand your organization’s dependencies.
PipeMagic masquerades as a ChatGPT desktop app
Microsoft has issued a warning about PipeMagic, a modular backdoor framework used by threat actor Storm-2460 that disguises itself as a ChatGPT desktop app and exploits a Windows zero-day to deploy ransomware.
PipeMagic uses encrypted named pipes and linked lists to manage payloads, execution, and C2 communication, making it highly evasive and dangerous.
Storm-2460 and PipeMagic
According to Microsoft, the Storm-2460 threat group has used PipeMagic in several instances—specifically during pre-exploitation activities of attacks involving CVE-2025-29824.
The group has been observed downloading a file from a compromised but legitimate website that hosts the actor’s malware. This downloaded file is an MSBuild file responsible for dropping and executing PipeMagic in memory. Once running on the device, the actor uses the Windows Common Log File System (CLFS) exploit to escalate privileges and launch their ransomware.
PipeMagic begins as an in-memory dropper disguised as a ChatGPT desktop application. To do this, the actor uses a modified version of the GitHub project that contains PipeMagic as an embedded payload. PipeMagic communicates with its C2 over TCP and receives modules through a named pipe.
Internal linked list structures
Microsoft identified four distinct doubly linked list structures used by PipeMagic to manage modules in memory:
- A payload-linked list that stores the payload modules.
- An execute-linked list that contains the payload modules that were successfully loaded and are therefore ready to be executed.
- A network-linked list containing networking modules for C2 communication.
- An unknown list, with no clear function. Microsoft believes “it is leveraged dynamically by loaded payloads rather than the core backdoor logic itself.”
Populating the payload-linked list
As noted, the payload-linked list is used to manage payload modules. Before initializing the list, the malware creates a random bot identifier for the host and then creates a named pipe for payload delivery.
This bidirectional pipe has read and write operations between the malware itself and the payload delivery mechanism. The malware listens on the named pipe to receive payload modules, allocates memory, and appends them to the payload-linked list.
Malware configuration
PipeMagic uses a structured configuration to manage staging modes, C2 addresses, and other operational parameters.
It has a staging mode that mimics C2 interactions without requiring active network connections. The malware has various configuration blocks that contain things like the C2 address.
Networking module
To communicate with the C2, the malware uses the network module in the network-linked list. It populates the lists with module notes, each of which has an executable module for C2 communication.
Microsoft found that the network module data was embedded directly in the backdoor binary. When the network module launches, it will export and register three functions—one to send data to the C2, one to return a constant value, and one to set a stop signal which instructs “both the backdoor and the network module to terminate all C2 communications.”
Information collection
The malware gathers a wide range of information to send back to its C2 server. Some of this information includes the computer name, domain NetBIOS name, user domain name, host IP address, and the malware’s current working directory.
All the information is sent back to the C2. When the malware receives a response from the C2, it will parse the data to interpret the command. The command tells the backdoor what to do next, including executing its core functionality, shutting down the network module to stop communication, and invoking all modules.
Backdoor capabilities
One of the commands Microsoft believes to be the most significant is code 0x1. This contains commands and arguments that give PipeMagic what it needs to conduct its backdoor operations.
Analyst comments from Tanium’s Cyber Threat Intelligence team
Storm-2460’s use of linked lists for payload management, execution, and communication demonstrates a high level of sophistication and discipline. The group is likely operating with significant resources.
PipeMagic is disguised as a trusted desktop app for ChatGPT. This reiterates the fact that threat actors often use lures and themes related to what is currently popular, in this case AI, to increase the likelihood of successful infections.
As always, Microsoft provides helpful mitigation and protection guidance along with Defender detections.
Noodlophile Stealer targets enterprises through social media
A recent report from Morphisec analyzes the Noodlophile Stealer, a rapidly evolving malware campaign that uses highly targeted, multilingual copyright-themed phishing emails to compromise enterprises with strong social media footprints.
According to Morphisec, Noodlophile Stealer leverages advanced evasion techniques and Telegram-based payload delivery to steal credentials, financial data, and system information while preparing for future capabilities like keylogging and file encryption.
The Noodlophile campaign has been active for more than a year. The campaign uses spear-phishing emails that impersonate copyright infringement notices, which include tailored reconnaissance details such as Facebook page IDs and ownership information.
The campaign primarily targets organizations in the United States, Europe, the Baltic countries, and APAC. Emails are sent to specific employees or generic addresses that typically begin with info@ or support@.
The lure
This campaign sends copyright violation emails related to Facebook pages, seeking to abuse the established trust organizations may have with Facebook—especially those with a heavy social media presence.
These emails frequently originate from Gmail accounts and combine a sense of urgency and legal threats to pressure the victim into clicking on malicious links or files. Morphisec notes that the campaign leverages multilingual content including English, Spanish, Polish, and Latvian.
Delivery mechanism
Earlier Noodlophile campaigns used fake AI platforms. However, the latest evolution delivers payloads via legitimate signed applications that are vulnerable to DLL sideloading.
The payloads are delivered via Dropbox links obfuscated with TinyURL redirects. The archives contain disguised artifacts, such as batch scripts named as .docx files or SFX archives masquerading as .png files.
Intermediate staging
After performing DLL sideloading, the campaign uses an intermediate stage to “bridge the initial execution and the deployment of the final stealer.”
Previously sideloaded DLLs rename archive files to mimic .pptx, .docx, or .pdf formats, revealing the true BAT scripts and Python interpreters. The BAT scripts are used to establish persistence by creating registry entries and downloading additional files from remote servers.
Payload analysis
Morphisec notes that the scripts are more heavily obfuscated than before. Instead of downloading the next stage directly, they will “extract a URL from the description of a Telegram group, enabling dynamic execution of the payload.” The final stealer is hosted on free platforms to make detection and takedown more difficult.
A closer look at Noodlophile Stealer’s evolution
Within Noodlophile Stealer’s codebase, Morphisec identified functions that reveal how the malware is rapidly evolving—and its plans to introduce future enhancements.
Some of the non-implemented functions they observed include screenshot capture, keylogging, file extraction, process monitoring, browser extension checks, and much more.
Currently, the malware collects browser-based data—such as credentials, system information, and environment details—with support for Chrome, Brave, Edge, Opera, and other browsers.
Analyst comments from Tanium’s Cyber Threat Intelligence team
The attacker has shifted beyond generic phishing in favor of tailored social engineering. This approach requires more reconnaissance to create believable lures.
The campaign also uses localized phishing content across different languages, suggesting that the actor could be leveraging AI tools for automated translation and personalization. Combined, these tactics can certainly make phishing simpler and more effective on a broader scale.
Do you have insight into these stories that you want to share? Head over to Tanium’s discussion forum to start a conversation.
For further reading, catch up on our recent cyber threat intelligence roundups.