🛡️ MAL-2025-6540 — mainx

Malicious code in mainx (PyPI)

Source: kam193

While described as educational package to simulate post-exploitation environment, the malware is active and once started, automatically attempts to exfiltrate sensitive data (credentials, cookies, etc.) and places a Discord implant. The remote target is hard coded in the code.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2025-06-mainx

Reasons (based on the campaign):

• obfuscation
• infostealer
• files-exfiltration
• exfiltration-credentials
• exfiltration-browser-data
• peristence-autorun
• The package contains code to detect if it is running in a sandbox environment.