Telnyx Python SDK PyPI Compromise — TeamPCP CanisterWorm Supply Chain Attack (telnyx 4.87.1/4.87.2) — Threadlinqs Intelligence
As of 2026-05-30, Telnyx Python SDK PyPI Compromise — TeamPCP CanisterWorm Supply Chain Attack (telnyx 4.87.1/4.87.2) is a critical-severity supply chain threat attributed to TeamPCP (Russia), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 23 indicators of compromise.
Threat ID: TL-2026-0361 · Severity: CRITICAL · CVSS: 9.8 · Status: MONITORING · Category: SUPPLY_CHAIN
Attribution: TeamPCP · Russia · ESPIONAGE
On 2026-03-27, the TeamPCP threat group published two backdoored versions of the official Telnyx Python SDK (telnyx 4.87.1 and 4.87.2) to PyPI, poisoning a package with 742K+ monthly downloads. The
Threadlinqs Research Intelligence — AII-Researcher — TL-2026-0361
1. OVERVIEW
On 2026-03-27, the group tracked as TeamPCP (aka CanisterWorm, PyPiggy, Akamai cluster UNC-4471) compromised the maintainer account of the official Telnyx Python SDK and pushed two trojanized releases to the Python Package Index: telnyx 4.87.1 and telnyx 4.87.2. Telnyx is a cloud communications provider whose SDK sees roughly 742,000 monthly downloads and is deeply embedded in CI/CD pipelines, serverless functions, and customer-service automation stacks. Both malicious releases were live on PyPI for approximately 11 hours before Telnyx, Akamai, and the PyPI security team coordinated a takedown and yanked the versions.
This intrusion is the fourth confirmed link in the TeamPCP CanisterWorm supply chain chain, following the 2025-Q4 LiteLLM poisoning, the 2026-01 Trivy release hijack, and the 2026-02 KICS package compromise. Akamai, Unit 42, Trend Micro, and Aikido all correlate the Telnyx implant with the same WAV-steganography loader, the same 83.142.209.203 C2 infrastructure, and the same ''TeamPCP'' internal project string that was pulled from recovered loader memory. Telemetry from Akamai, PyPI download logs, and CI runner signals place the number of impacted hosts at more than 500,000 machines and the aggregate exfiltration volume at roughly 300 GB of source code, cloud tokens, and CI secrets.
2. INFECTION CHAIN
Stage 0 — PyPI poisoning.
TeamPCP obtained the Telnyx PyPI maintainer credentials (believed to be via phishing of a Telnyx DX engineer in mid-March 2026). They pushed telnyx 4.87.1 and telnyx 4.87.2 with a lightly modified ''telnyx/_payload_loader.py'' that runs on import. The loader is gated: it only fires when it detects a Python interpreter outside of known sandbox environments (no `pytest`, no `GITHUB_ACTIONS=true` in preview builds, no `CI=true` with known linter runners), which delayed detection by automated malware sandboxes.
Stage 1 — WAV steganography retrieval.
On activation the loader fetches one of several WAV files from attacker infrastructure (CDN-fronted at ''sounds.telnyx-support.com'' — an attacker-controlled look-alike domain — and mirrors on Dropbox and a public S3 bucket). The WAV is a real playable audio file, but the lower 2 bits of each 16-bit PCM sample encode a ChaCha20-encrypted Python stager. After decryption, the stager is executed via `exec()` directly from memory. Unit 42 dubbed this loader ''CanisterWorm-Whisper''.
Stage 2A — Windows persistence (msbuild.exe).
On Windows the stager writes a renamed Microsoft-signed binary to `%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\msbuild.exe`. The file is an unmodified copy of Visual Studio's msbuild, abused as a living-off-the-land binary to load an inline C# task pulled from an accompanying XML project file (`build.xml`). That C# task is the real stealer: it harvests browser credentials, SSH keys, AWS/GCP/Azure CLI tokens, Discord tokens, and any `.env` or `config.*.json` files found under the user profile.
Stage 2B — Linux/macOS in-memory collector.
On POSIX systems the stager skips disk persistence entirely and runs an in-memory Python ''collector'' that walks `~/.ssh`, `~/.aws`, `~/.config/gh`, `~/.kube`, `~/.docker`, `~/.npmrc`, and common developer dotfiles, bundles them into a tar stream, and exfiltrates over TLS to the C2. A lightweight reinfection hook is written as a shell alias in `~/.bashrc`/`~/.zshrc` that re-executes the loader on the next shell launch.
Stage 3 — Command and control.
Both variants beacon to 83.142.209.203 on TCP 8080 using a custom protocol wrapped in TLS 1.2 with a self-signed certificate whose CN is ''pcp-sync''. The same IP was observed hosting the LiteLLM, Trivy, and KICS C2 nodes, which is the primary basis for clustering the four campaigns together. Secondary beacons resolve through ''pcp-sync.duckdns.org'' and ''teampcp[.]cc''.
3. ATTRIBUTION
TeamPCP is an actor cluster that surfaced publicly in 2025-Q4 with the
Weaknesses (CWE)
CWE-506, CWE-494, CWE-1357, CWE-829
Target sectors: technology, telecommunications, financial, healthcare, saas, devops, government
Target regions: North America, Europe, Asia Pacific, South America
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 23 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, T1586, T1586.002, T1583.001, T1608.001, T1195.001, T1566.002, T1059.006, T1059.004, T1204.002, T1547.001