fetchapi-syncdata-pypi

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: kam193 (d0dcf5bd5c71d077b3763c74d57d68d5517a2b5c5229fdd5bd6f7369cb2a0f49)
The package contains code to download and start a malicious executable. It's masqueraded using name similar to Windows services. In analyzed versions, the code was not automatically started, suggesting it's just a part of a campaign.  Based on the dynamic analysis, the executable is likely an infostealer.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-04-fetch-data-api-syncapi


Reasons (based on the campaign):


 - Downloads and executes a remote executable.


 - malware

Compromised versions (1)

• 0.1.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.