{"id":"MAL-2026-17755","kind":"package","aliases":["MAL-2026-17755"],"related":[],"title":"Malicious code in agent-vx (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (90f0a2b273b0361ffd4057f114f1be1eaf9469c9746d2737a21947905570ff80)\nOn `import agentaix`, the package's __init__.py runs a top-level `install_manage()` side effect that renames a bundled `readme.txt` into `manage.py` and launches it with pythonw.exe using CREATE_NO_WINDOW so no console appears. The disguised script registers the installer as `username@hostname` with https://googleforum.pythonanywhere.com and then polls that endpoint for commands. The command handlers include `exec` (arbitrary shell via `subprocess.run(command, shell=True)`), plus list, download, upload, delete, rename, and open — a full remote-controlled shell and file manager driven by a hardcoded author endpoint, with no authentication beyond the username@hostname identifier. The `download` handler reads any path accessible to the user process, base64-encodes the contents, and POSTs them back to https://googleforum.pythonanywhere.com/api/client/<id>/result, enabling remote-triggered exfiltration of arbitrary files. For persistence, `_add_to_startup` writes an `AgentAIXManage` value under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run pointing at pythonw.exe plus the renamed script so the C2 client auto-starts at every user login. The payload fires the moment the module is imported, with no user interaction, and the readme.txt disguise plus hidden-window launch are deliberate evasion of casual inspection.\n\n## Source: kam193 (f91699ff915dd2020b9736052f7036ee723aaaa0628e5384ff47f65577d397f6)\nThe package installs a persistent job that allows the attacker for exfiltrating files and executing remote code on the victim's machine.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-agentaix\n\n\nReasons (based on the campaign):\n\n\n - files-exfiltration\n\n\n - peristence-autorun\n\n\n - The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.\n\n\n - rat\n\n\n - persistence\n\n\n - Downloads and executes a remote malicious script.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"agent-vx","fixed":[],"affected":"= 0.1.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-10T11:19:48+00:00","first_seen_at":"2026-10-26T20:51:59+00:00","triaged_at":"2026-10-26T21:06:18+00:00","updated_at":"2026-10-26T21:06:18+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-10':263C '-17755':10A,13A '-2026':9A,12A '/api/client/':154C '/result':155C '2026':262C '90f0a2b273b0361ffd4057f114f1be1eaf9469c9746d2737a21947905570ff80':32C 'access':137C 'add':166C 'agent':5A,15A 'agent-vx':4A,14A 'agentaix':35C,264C 'agentaixmanag':171C 'allow':236C 'amazon':30C 'amazon-inspector':29C 'appear':69C 'arbitrari':93C,162C 'attack':238C 'authent':125C 'author':121C 'auto':192C 'auto-start':191C 'autorun':275C 'back':150C 'base':266C 'base64':143C 'base64-encodes':142C 'beyond':126C 'bundl':53C 'c2':189C 'campaign':254C,261C,269C 'casual':224C 'categori':251C 'clear':256C 'client':190C 'code':2A,245C,279C 'command':87C,89C,97C,283C 'consol':68C 'contain':278C 'content':146C 'control':112C 'creat':63C 'currentvers':178C 'delet':104C 'deliber':221C 'detail':21C 'disguis':71C,214C 'download':102C,132C,297C 'driven':117C 'edit':24C 'effect':49C 'enabl':156C 'encod':144C 'endpoint':85C,122C 'evas':222C 'everi':195C 'exec':92C 'execut':243C,281C,299C 'exfiltr':160C,240C,272C 'f91699ff915dd2020b9736052f7036ee723aaaa0628e5384ff47f65577d397f6':228C 'file':115C,163C,241C,271C 'files-exfiltr':270C 'fire':200C 'full':109C 'googleforum.pythonanywhere.com':80C,153C 'googleforum.pythonanywhere.com/api/client/':152C 'handler':90C,133C 'hardcod':120C 'hidden':217C 'hidden-window':216C 'hkcu':174C 'hostnam':78C,129C 'identifi':130C 'import':34C,206C 'includ':91C 'infosteal':260C 'init':39C 'inspect':225C 'inspector':31C 'instal':46C,75C,231C 'intent':258C 'interact':210C 'job':234C 'kam193':227C 'launch':58C,219C 'level':45C 'like':259C 'limit':285C 'line':27C 'list':101C 'login':197C 'machin':250C,294C 'mal':8A,11A 'malici':1A,17B,252C,257C,302C 'manag':47C,116C 'manage.py':56C 'microsoft':176C 'modul':204C 'moment':202C 'open':107C 'packag':18B,37C,230C,277C 'path':136C 'payload':199C 'per':19C 'perist':274C 'peristence-autorun':273C 'persist':165C,233C,296C 'plus':100C,183C,215C 'point':180C 'poll':83C 'post':148C 'probabl':284C 'process':141C 'py':40C 'pypi':7A 'pythonw.exe':61C,182C 'rat':295C 'read':134C 'readme.txt':54C,213C 'reason':265C 'regist':73C 'remot':111C,158C,244C,282C,301C 'remote-control':110C 'remote-trigg':157C 'renam':51C,105C,185C 'run':41C,179C 'script':72C,186C,303C 'set':289C 'shell':94C,98C,113C 'side':48C 'softwar':175C 'sourc':20C,28C,226C 'specif':288C 'start':193C 'startup':168C 'subprocess.run':96C 'top':44C 'top-level':43C 'trigger':159C 'true':99C 'upload':103C 'use':62C 'user':140C,196C,209C 'usernam':77C,128C 'valu':172C 'via':95C 'victim':248C,292C 'vx':6A,16A 'window':65C,177C,218C 'write':169C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-10T11:19:48+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-17755","url":"https://osv.dev/vulnerability/MAL-2026-17755","severity":"critical","published_at":"2026-10-10T11:19:48+00:00","modified_at":"2026-10-15T09:30:03+00:00","first_seen_at":"2026-10-26T20:51:59+00:00","fetched_at":"2026-10-26T20:51:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}