Skip to content
r/programming

TeamPCP strikes again - telnyx 4.87.1 and...

Same actor, same RSA key, same `tpcp.tar.gz` exfiltration header as the litellm compromise last week. This time they injected into `telnyx/_client.py` \- triggers on `import telnyx`, no user interaction needed. New trick: payload is hidden inside WAV audio files using steganography to bypass network inspection. On Linux/macOS: steals credentials, encrypts with AES-256 + RSA-4096, exfiltrates to their C2. On Windows: drops a persistent binary in the Startup folder named `msbuild.exe`. They even p
Read original on reddit.com
266
49

2 comments

techfan421h ago

This is a really insightful piece. The data backs up what I've been seeing in the industry.

devops_sam45m ago

Agreed. Would love to see a follow-up with more recent numbers.

curious_reader2h ago

I'm not sure the conclusion holds for smaller teams. Would be interesting to see this broken down by company size.

Related

Liked this? Start your own feed.

Your own feed is waiting.
266
49