Cybersecurity researchers have discovered two malicious packages in the Python Package Index (PyPI) repository that masqueraded as spellchecking utilities but contained a sophisticated remote access trojan (RAT) with cryptocurrency-stealing capabilities. The packages were downloaded over 1,000 times before removal.

Malicious packages

Package NameDownloadsUpload DateStatus
spellcheckerpy~500January 20, 2026Removed
spellcheckpy~500January 21, 2026Removed

Both packages claimed to be from the legitimate author of the pyspellchecker library, exploiting developer trust in the popular spelling correction tool.

Detection

Aikido Security’s malware detection pipeline flagged the packages on January 20-21, 2026. Analysis revealed heavily obfuscated code designed to evade static scanners and deliver a RAT payload.

Attack chain

Stage 1: Installation and trigger

When a developer installs the package and imports the SpellChecker class:

from spellchecker import SpellChecker
checker = SpellChecker()  # RAT executes here

The instantiation triggers the malicious payload—no explicit malicious function call required.

Stage 2: Obfuscation bypass

Instead of using obvious exec() calls that static scanners flag, the malware:

  1. Reconstructs the exec string from hexadecimal at runtime
  2. Decodes embedded payload
  3. Executes in-memory

Stage 3: Downloader execution

The stage-1 payload is a downloader that:

  1. Fetches the real payload from https://updatenet[.]work/settings/history.php
  2. Spawns the RAT in a detached process
  3. Continues even if the original Python script exits

Stage 4: Fileless persistence

The RAT operates entirely in memory:

  • No files written to disk
  • Silent execution
  • Detached from parent process
  • Survives script termination

RAT capabilities

CapabilityDescription
Remote command executionExecute arbitrary commands on victim system
Cryptocurrency wallet theftExtract wallets, seed phrases, private keys
Browser data exfiltrationCredentials, history, cookies, autofill
File exfiltrationUpload files to attacker infrastructure
Screen captureScreenshot victim’s display
PersistenceMaintain access across reboots

Targeted data

CategoryTargets
Crypto walletsMetaMask, Phantom, Exodus, Coinbase Wallet, Trust Wallet
BrowsersChrome, Brave, Edge, Firefox, Opera
Password managersBrowser-stored credentials
2FA codesAuthenticator backup codes

Threat actor connection

November 2025 campaign

In November 2025, HelixGuard documented a similar attack using a package named “spellcheckers” (different name, same target):

AttributeNovember 2025January 2026
Package namespellcheckersspellcheckerpy, spellcheckpy
RAT structureXOR encryption, command ID 1001, exec()Identical structure
C2 domaindothebest[.]storeupdatenet[.]work
Social engineeringFake recruiter targeting crypto holdersDirect PyPI targeting

Fake recruiter campaign

The November 2025 campaign analysis revealed additional context:

ElementDetails
Distribution methodFake recruiter social engineering
TargetsCryptocurrency holders via social media
LureFake job offers from “recruiters”
InfectionVictims directed to install malicious package
GoalCryptocurrency theft

Assessment: Same threat actor, different infrastructure. The consistent methodology—targeting spellchecker libraries to reach developers, using multi-layer encryption, stealing cryptocurrency—indicates an ongoing campaign.

Zscaler ThreatLabz findings

DatePackagePayload
July 2025termncolorSilentSync RAT
August 2025sisawsSilentSync RAT
August 2025secmeasureSilentSync RAT

These packages delivered a RAT dubbed SilentSync, retrieved from Pastebin—a similar pattern to the spellchecker campaigns.

Q2 2025 statistics (FortiGuard Labs)

Threat typePrevalence
Credential stealersHigh
Cryptocurrency drainersIncreasing
CryptojackersModerate
ClippersEmerging

Socket.dev identified these as the main threat types targeting the cryptocurrency and blockchain development ecosystem.

Technical indicators

Network IOCs

updatenet[.]work (C2 server - January 2026)
dothebest[.]store (C2 server - November 2025)
/settings/history.php (payload endpoint)
/refresh.php (RAT communication endpoint)

Behavioral indicators

  • Python process making unexpected HTTPS connections
  • Network traffic to unfamiliar domains after pip install
  • Cryptocurrency wallet file access from Python process
  • Browser credential store access

Detection opportunities

StageDetection Method
InstallationDependency scanning (Snyk, Dependabot, Socket)
ExecutionEDR monitoring for Python child processes
C2 communicationNetwork monitoring for unknown domains
Data theftDLP alerts on wallet/credential access

PyPI security improvements

PyPI announced a significant security enhancement taking effect February 1, 2026:

“After 6 months of warnings, on February 1st, 2026, PyPI will begin rejecting newly uploaded wheels whose ZIP contents don’t match the included RECORD metadata file.”

ChangeImpact
ZIP/RECORD validationPrevents some tampering techniques
Metadata integrityStronger package verification
Upload rejectionInvalid packages blocked
Effective dateFebruary 1, 2026

While this doesn’t prevent all malicious packages, it closes one avenue for package manipulation.

Supply chain context

This incident reflects ongoing risks in open-source package ecosystems:

Why PyPI attacks work

FactorRisk
Open publishingAnyone can publish with minimal vetting
Transitive dependenciesMalicious packages pulled in indirectly
Elevated privilegesPackages run with full system access
CI/CD automationAutomatic installation during builds
Developer trustAssumption that packages are safe

Attack frequency

Malicious package campaigns have increased across all major ecosystems:

EcosystemLanguageTrend
PyPIPythonIncreasing
npmJavaScriptIncreasing
RubyGemsRubyModerate
NuGet.NETEmerging
CargoRustEmerging

Recommendations

For developers

PracticeBenefit
Verify package namesCatch typosquatting
Check publisher reputationIdentify suspicious accounts
Review package sourceSpot obvious malware
Pin versionsPrevent unexpected updates
Use lockfilesEnsure reproducible builds
Verify downloadsCheck package popularity/history

For organizations

ControlImplementation
Private registriesPre-approved packages only
Dependency scanningSnyk, Dependabot, Socket, Mend
CI/CD monitoringAlert on new dependencies
Network segmentationIsolate build environments
Software composition analysisOngoing visibility
Egress filteringBlock unauthorized C2 communication

If you installed these packages

  1. Remove immediately: pip uninstall spellcheckerpy spellcheckpy
  2. Scan for persistence: Check for unknown processes, scheduled tasks
  3. Rotate credentials: All passwords, API keys, crypto wallets
  4. Move crypto assets: Transfer to fresh wallets with new seed phrases
  5. Audit access: Review account activity for unauthorized access
  6. Report: Notify security team, consider incident response
  7. Check transitive dependencies: Verify other packages weren’t affected

Context

The “spellchecker” attack pattern demonstrates attacker sophistication in targeting developers. By impersonating legitimate, commonly-used packages, attackers achieve:

  • Trust exploitation — Developers expect pyspellchecker to be safe
  • Wide distribution — Popular package types get more installs
  • High-value targets — Developers often have crypto holdings and access to production systems

The fileless execution and detached process technique makes detection difficult. Traditional antivirus may not flag activity that never touches disk.

Cryptocurrency targeting trend

FactorAttacker interest
Developer demographicsHigher crypto ownership
Production accessKeys and secrets available
Automation environmentsCI/CD secrets exposed
Wallet filesDirectly accessible
Browser credentialsExchange logins

Organizations should treat package installation as a security-critical operation, implementing the same controls applied to downloading and executing unknown software.