# TeamPCP Supply Chain Attack via Backdoored Telnyx PyPI Package with Steganographic WAV Payloads

> Threat actor TeamPCP compromised the Telnyx Python SDK on PyPI (742K+ monthly downloads), publishing malicious versions 4.87.1 and 4.87.2 on March 27, 2026 that execute credential-stealing malware on import. Second-stage payloads are hidden in steganographic WAV audio files served from a remote C2 server, with platform-specific variants targeting Linux, macOS, and Windows. The attack includes Kubernetes lateral movement capabilities deploying privileged pods across cluster nodes.

- **Published:** 2026-03-30T12:00:00Z
- **Last reviewed:** 2026-03-30T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0298
- **ID:** TL-2026-0298
- **Severity:** CRITICAL
- **Category:** SUPPLY_CHAIN
- **Status:** MONITORING
- **Actor:** TeamPCP (Russia)
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)

## Description

TeamPCP, a prolific supply chain threat actor, compromised the official Telnyx Python SDK on PyPI by publishing two malicious versions (4.87.1 and 4.87.2) on March 27, 2026. The Telnyx SDK is widely used for VoIP, messaging, fax, and IoT connectivity, averaging over 742,000 downloads per month.

The sole modified file was telnyx/_client.py, with exactly 74 lines of malicious code injected at three locations: malicious imports at lines 4-16 (subprocess, tempfile, wave, urllib.request, base64), a 4,436-character base64-encoded payload variable '_p' at line 459, and attack functions setup() and FetchAudio() appended after legitimate class definitions at lines 7761-7817. The malicious code executes at module scope during import — no explicit function calls or installation hooks are required.

The initial version 4.87.1 (published at 03:51 UTC) contained a casing bug (Setup() vs setup()) causing a NameError that prevented execution. TeamPCP corrected this within 16 minutes, releasing version 4.87.2 at 04:07 UTC with a single-line fix making both attack paths functional. PyPI quarantined both versions at 10:13 UTC, creating an approximately 6-hour window of active exploitation.

The attack employs a novel steganographic delivery mechanism using WAV audio files. On Linux/macOS, the malware spawns a detached subprocess that downloads ringtone.wav from the C2 server at 83.142.209.203:8080. The WAV file is a valid audio container where frame data contains base64-encoded payloads instead of actual audio. Extraction follows a three-step process: base64-decode the WAV frame data, extract the first 8 bytes as the XOR key, then XOR-decrypt the remaining bytes using repeating-key XOR to recover the executable payload.

On Linux/macOS, the decoded payload is a comprehensive credential harvester that targets SSH keys, cloud credentials (AWS, GCP, Azure), Docker and npm authentication tokens, Git credentials, Vault secrets, database credentials, environment variables, .env files, shell histories, and cryptocurrency wallet data. Stolen data is encrypted using a multi-layer scheme: a random AES-256-CBC session key generated via openssl rand, data encrypted with AES-256-CBC using PBKDF2 key derivation, and the session key wrapped with an attacker-controlled RSA-4096 public key using OAEP padding. The encrypted archive is exfiltrated as tpcp.tar.gz via HTTP POST to the C2 server. The harvester operates within a self-destructing temporary directory, leaving near-zero forensic artifacts. Linux persistence is established via ~/.config/audiomon/audiomon.py with a systemd user service at ~/.config/systemd/user/audiomon.service.

If Kubernetes is detected on the infected system, the malware enumerates cluster secrets using compromised service account tokens and deploys privileged pods to every node in the kube-system namespace. These pods mount the host root filesystem at /host with hostPID, hostNetwork, and privileged: True, then perform a chroot operation into the host filesystem to install persistence mechanisms directly on nodes. Pod names follow the pattern node-setup-*, with containers named kamikaze, provisioner, host-provisioner-iran, and host-provisioner-std.

On Windows, the malware downloads hangup.wav from the same C2 server, extracts an XOR-obfuscated executable from the audio frames, and drops it as msbuild.exe in the Windows Startup folder (%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\) — masquerading as the legitimate Microsoft Build Engine. A hidden .lock file prevents re-execution within a 12-hour window. The executable is launched with the CREATE_NO_WINDOW flag for silent operation.

Attribution to TeamPCP is confirmed with high confidence through three overlapping indicators: an identical RSA-4096 public key shared byte-for-byte with the LiteLLM PyPI compromise (March 24, 2026), the tpcp.tar.gz archive naming convention and X-Filename header (TeamPCP signature), and an identical AES-256-CBC + RSA OAEP encryption pipeline. The compromise is part of a broader TeamPCP campaign spanning March 19-27, 2026, targeting Trivy (CVE-2026-33634), npm (CanisterWorm, 46+ packages), Checkmarx GitHub Actions, LiteLLM PyPI, and Telnyx PyPI.

Root cause analysis indicates TeamPCP obtained the PyPI API token (PYPI_TOKEN) through prior credential harvesting, likely from the LiteLLM compromise. No malicious commits exist in the GitHub repository — all pushes came from legitimate automation (stainless-app[bot]). The malicious uploads used twine/6.2.0 instead of the expected rye CI tool, and no corresponding GitHub release tags exist for versions 4.87.1 or 4.87.2. The Telnyx PyPI project did not have trusted publishers (OIDC) configured, which would have prevented unauthorized uploads.

The malware does not verify downloaded WAV files cryptographically before execution, creating an additional risk where man-in-the-middle attackers could inject alternative payloads targeting TeamPCP-compromised systems.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1547 Boot or Logon Autostart Execution
- T1543 Create or Modify System Process
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1070 Indicator Removal
- T1552 Unsecured Credentials
- T1082 System Information Discovery
- T1087 Account Discovery
- T1570 Lateral Tool Transfer
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1610 Deploy Container
- T1611 Escape to Host

## Sources

- [Trend Micro: TeamPCP Telnyx Attack Marks a Shift in Tactics](https://www.trendmicro.com/en_us/research/26/c/teampcp-telnyx-attack-marks-a-shift-in-tactics.html)
- [BleepingComputer: Backdoored Telnyx PyPI Package Pushes Malware Hidden in WAV Audio](https://www.bleepingcomputer.com/news/security/backdoored-telnyx-pypi-package-pushes-malware-hidden-in-wav-audio/)
- [Aikido: Popular telnyx Package Compromised on PyPI by TeamPCP](https://www.aikido.dev/blog/telnyx-pypi-compromised-teampcp-canisterworm)
- [Datadog Security Labs: LiteLLM and Telnyx Compromised - Tracing the TeamPCP Campaign](https://securitylabs.datadoghq.com/articles/litellm-compromised-pypi-teampcp-supply-chain-campaign/)
- [SafeDep: Compromised telnyx on PyPI - WAV Steganography and Credential Theft](https://safedep.io/malicious-telnyx-pypi-compromise/)
- [JFrog: TeamPCP Strikes Again - Telnyx Popular Library Hit](https://research.jfrog.com/post/team-pcp-strikes-again-telnyx-popular-library-hit/)
- [The Hacker News: TeamPCP Pushes Malicious Telnyx Versions to PyPI](https://thehackernews.com/2026/03/teampcp-pushes-malicious-telnyx.html)
- [Help Net Security: TeamPCP Strikes Again - Backdoored Telnyx PyPI Package](https://www.helpnetsecurity.com/2026/03/27/teampcp-telnyx-supply-chain-compromise/)
- [OX Security: Telnyx Malware - TeamPCP Following LiteLLM Compromise](https://www.ox.security/blog/telnyx-malware-teampcp-strikes-again-following-litellm-compromise/)
- [Mend.io: Famous Telnyx PyPI Package Compromised by TeamPCP](https://www.mend.io/blog/famous-telnyx-pypi-package-compromised-by-teampcp/)
- [GitHub Issue #235: PyPI Versions 4.87.1 and 4.87.2 Are Compromised](https://github.com/team-telnyx/telnyx-python/issues/235)
- [Telnyx Security Notice: Malicious PyPI Versions Identified](https://telnyx.com/resources/telnyx-python-sdk-supply-chain-security-notice-march-2026)
- [Python Advisory PYSEC-2026-3](https://pypi.org/project/telnyx/)
- [CyberSecurityNews: Telnyx PyPI Package With 742,000 Downloads Compromised](https://cybersecuritynews.com/telnyx-pypi-package-compromised/)
- [Infosecurity Magazine: TeamPCP Targets Telnyx in Latest Supply Chain Attack](https://www.infosecurity-magazine.com/news/teampcp-targets-telnyx-pypi-package/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0298