{"id":"MAL-2026-17712","kind":"package","aliases":["MAL-2026-17712"],"related":[],"title":"Malicious code in ig-gox (PyPI)","description":"Importing ig_gox runs ig_gox/__init__.py, which decodes a blob (base64, XOR, zlib) after a few anti-debugging checks and execs it as __main__. The decoded loader only goes on if it looks like a physical Android device running Termux (it turns away x86, emulators and VMs), installs requests and cryptography if they are missing, downloads encrypted code from https://goxtools.shop/api/admin/storage.php, decrypts it with AES-256-CBC and runs it in memory. The README only calls it a runtime engine for Termux. I decoded the loader statically and did not see what the downloaded code does. I read 1.0.0 and did not run it.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9b31f8ba5b2167be45b02cd3bbf840873adf76369e3ac472f1cccfc4a0579fff)\nThe pypi package ig-gox ships a top-level ig_gox/__init__.py that, on import (the README's documented usage), base64-decodes a ~5 KB embedded blob, XOR-decrypts it with a hardcoded key, zlib-decompresses it, HMAC-verifies it, then exec/compiles the resulting Python under __name__='__main__'. The visible wrapper has no other functionality; all actual behavior of the package is contained in that concealed blob. Before decoding, the module performs anti-analysis checks: it calls sys.exit(0) if sys.gettrace() returns a tracer, if the process environment/cwd/argv contain substrings such as 'uncompyle', 'pycdc', 'decompyle', 'deobfuscate', 'hook', or 'frida', and it tampers with references to builtins.exec/eval/compile. The combination of a hidden exec-of-decoded-payload reached automatically on import and explicit evasions against debuggers and decompilers is deliberate concealment of code execution from the installer and from reviewers.\n\n## Source: kam193 (780638a0747103eb44a85312a2cfb552981e498655f638c5baf86eb4a5f74042)\nPackage hides obfuscated code aimed to avoid analysis and downloading the remote stage. The remote code is used to abuse Instagram service for mass fake account registration.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-ig-gox\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to detect if it is running in a sandbox environment.\n\n\n - obfuscation\n\n\n - Downloads and executes a remote malicious script.\n\n\n - abusing-3rd-api","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ig-gox","fixed":[],"affected":"= 1.0.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-09T02:53:23+00:00","first_seen_at":"2026-10-26T20:51:59+00:00","triaged_at":"2026-10-26T21:08:21+00:00","updated_at":"2026-10-26T21:08:21+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-10':328C '-17712':10A,13A '-2026':9A,12A '-256':86C '/api/admin/storage.php,':81C '/eval/compile.':252C '0':223C '1.0.0':119C '2026':327C '3rd':361C '5':164C '780638a0747103eb44a85312a2cfb552981e498655f638c5baf86eb4a5f74042':288C '9b31f8ba5b2167be45b02cd3bbf840873adf76369e3ac472f1cccfc4a0579fff':138C 'abus':308C,360C 'abusing-3rd-api':359C 'account':314C 'actual':200C 'ae':85C 'aim':293C 'amazon':136C 'amazon-inspector':135C 'analysi':218C,296C 'android':56C 'anti':36C,217C 'anti-analysi':216C 'anti-debug':35C 'api':362C 'automat':264C 'avoid':295C 'away':62C 'base':333C 'base64':29C,161C 'base64-decodes':160C 'behavior':201C 'blob':28C,167C,210C 'builtins.exec':251C 'builtins.exec/eval/compile.':250C 'call':96C,221C 'campaign':319C,326C,336C 'categori':316C 'cbc':87C 'check':38C,219C 'clear':321C 'code':2A,77C,115C,278C,292C,304C,340C 'combin':254C 'conceal':209C,276C 'contain':206C,233C,339C 'cryptographi':70C 'debug':37C 'debugg':271C 'decod':26C,45C,104C,162C,212C,261C 'decompil':273C 'decompress':178C 'decompyl':239C 'decrypt':82C,170C 'deliber':275C 'deobfusc':240C 'detail':127C 'detect':342C 'devic':57C 'document':158C 'download':75C,114C,298C,352C 'edit':130C 'embed':166C 'emul':64C 'encrypt':76C 'engin':100C 'environ':350C 'environment/cwd/argv':232C 'evas':269C 'exec':40C,259C 'exec-of-decoded-payload':258C 'exec/compiles':185C 'execut':279C,354C 'explicit':268C 'fake':313C 'frida':243C 'function':198C 'goe':48C 'gox':6A,16A,21C,144C,331C 'gox/__init__.py':24C,151C 'goxtools.shop':80C 'goxtools.shop/api/admin/storage.php,':79C 'hardcod':174C 'hidden':257C 'hide':290C 'hmac':181C 'hmac-verifi':180C 'hook':241C 'ig':5A,15A,20C,23C,143C,150C,330C 'ig-gox':4A,14A,142C,329C 'import':19C,154C,266C 'infosteal':325C 'inspector':137C 'instagram':309C 'instal':67C,282C 'intent':323C 'kam193':287C 'kb':165C 'key':175C 'level':149C 'like':53C,324C 'line':133C 'loader':46C,106C 'look':52C 'main':43C,191C 'mal':8A,11A 'malici':1A,17B,317C,322C,357C 'mass':312C 'memori':92C 'miss':74C 'modul':214C 'name':190C 'obfusc':291C,351C 'packag':18B,141C,204C,289C,338C 'payload':262C 'per':125C 'perform':215C 'physic':55C 'process':231C 'pycdc':238C 'pypi':7A,140C 'python':188C 'reach':263C 'read':118C 'readm':94C,156C 'reason':332C 'refer':248C 'registr':315C 'remot':300C,303C,356C 'request':68C 'result':187C 'return':226C 'review':285C 'run':22C,58C,89C,123C,346C 'runtim':99C 'sandbox':349C 'script':358C 'see':111C 'servic':310C 'ship':145C 'sourc':126C,134C,286C 'stage':301C 'static':107C 'substr':234C 'sys.exit':222C 'sys.gettrace':225C 'tamper':246C 'termux':59C,102C 'top':148C 'top-level':147C 'tracer':228C 'turn':61C 'uncompyl':237C 'usag':159C 'use':306C 'verifi':182C 'visibl':193C 'vms':66C 'wrapper':194C 'x86':63C 'xor':30C,169C 'xor-decrypt':168C 'zlib':31C,177C 'zlib-decompress':176C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-09T02:53:23+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-17712","url":"https://osv.dev/vulnerability/MAL-2026-17712","severity":"critical","published_at":"2026-10-09T02:53:23+00:00","modified_at":"2026-10-12T05:00:07+00:00","first_seen_at":"2026-10-26T20:51:59+00:00","fetched_at":"2026-10-26T20:51:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}