In July 2025, threat hunters identified a sophisticated supply chain attack targeting Python developers through malicious wheel packages uploaded to PyPI (Python Package Index). These packages, while appearing to provide legitimate functionality, were designed to covertly deliver malware. The campaign introduced a previously unknown malware family named ZiChatBot, which leveraged unconventional command-and-control (C2) infrastructure through the public team chat application Zulip. This case highlights the growing risks of open-source ecosystems being exploited by advanced persistent threat (APT) groups.

Attack Overview

The attackers uploaded three malicious projects to PyPI: uuid32-utils, colorinal, and termncolor. While these libraries mimicked popular utilities, their true purpose was to act as droppers for ZiChatBot. The infection chain was carefully concealed:

• colorinal contained the primary malicious payload.
• termncolor appeared benign but imported colorinal as a dependency, masking the infection.
• Both Windows and Linux versions were supported, with payloads delivered via .DLL and .SO files respectively.

This strategy demonstrates a multi-layered concealment technique, making detection difficult for casual developers relying on PyPI packages.

Technical Details

Windows Infection Chain

• Installation of colorinal-0.1.7 extracted a malicious DLL (terminate.dll).
• The __init__.py script imported and executed unicode.py, which loaded the DLL into the Python process.
• The DLL deployed ZiChatBot, established persistence via registry auto-run entries, and self-deleted to erase traces.

Linux Infection Chain

• The dropper (terminate.so) placed ZiChatBot in /tmp/obsHub/obs-check-update.
• Persistence was achieved using crontab jobs, ensuring execution every five minutes.

ZiChatBot Functionality

• ZiChatBot used Zulip REST APIs as its C2 infrastructure, bypassing traditional server-based communication.
• It transmitted system information and retrieved shellcode via Zulip channels.
• Successful execution was confirmed by sending a heart emoji back to the attacker-controlled Zulip account.

Attribution

Analysis using the Kaspersky Threat Attribution Engine (KTAE) revealed a 64% similarity between ZiChatBot’s dropper and malware linked to OceanLotus (APT32). OceanLotus has historically targeted Asia-Pacific victims but has expanded operations globally, including the Middle East. This PyPI-based campaign aligns with their evolving strategy of exploiting developer ecosystems and supply chain vectors.

Infrastructure and Mitigation

Unlike traditional campaigns, no dedicated servers or VPS infrastructure were found. Instead, attackers relied entirely on PyPI distribution and Zulip APIs. The Zulip organization used for C2 has since been deactivated, but defenders are advised to block helper.zulipchat.com to prevent residual connections.

Our Opinion

This case underscores the fragility of trust in open-source ecosystems. Developers worldwide rely on PyPI for critical libraries, often without rigorous validation of package authenticity. The ZiChatBot campaign demonstrates how attackers can exploit this trust by embedding malicious payloads in seemingly useful utilities. What makes this attack particularly concerning is the creative use of Zulip’s public APIs as a command-and-control mechanism. By blending malicious traffic with legitimate API calls, the attackers effectively bypassed traditional detection methods.

From a defensive standpoint, this incident highlights the urgent need for supply chain security frameworks. Package repositories like PyPI must adopt stronger vetting processes, automated malware scanning, and dependency validation. At the same time, organizations should implement software composition analysis (SCA) tools to detect suspicious dependencies before deployment. OceanLotus’s involvement further illustrates the globalization of APT strategies. By targeting developers directly, they gain access to downstream victims who unknowingly integrate compromised libraries into production environments. This amplifies the impact far beyond individual infections. In our view, this attack is a wake-up call for the developer community: security must become a first-class concern in open-source development. Without proactive defenses, supply chain attacks like ZiChatBot will continue to erode trust in shared ecosystems.