MAL-2026-17861
Malicious code in sysdiagd (PyPI)
Published Oct 13, 2026 · updated Oct 13, 2026
--- _-= Per source details. Do not edit below this line.=-_ ## Source: kam193 (0d396ad34176d29956d695014d261847ada859c184d7a8e7820d96087af7eafe) Disguised as a system monitoring tool, the package delivers a Discord bot acting as an infostealer exfiltrating credentials, browser data, files and recording audio, screenshots and video. The code requires providing bot credentials, it is not functional without providing them. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-sysdiagd Reasons (based on the campaign): - rat - exfiltration-browser-data - persistence - exfiltration-credentials - files-exfiltration - spyware-like - infostealer
Timeline
Detection, updates, and resolution for this record.
Oct 13, 2026 · Catalog
Detected
--- _-= Per source details. Do not edit below this line.=-_ ## Source: kam193 (0d396ad34176d29956d695014d261847ada859c184d7a8e7820d96087af7eafe) Disguised as a system monitoring tool, the package delivers a Discord bot acting as an infostealer exfiltrating credentials, browser data, files and recording audio, screenshots and video. The code requires providing bot credentials, it is not functional
Oct 13, 2026 · Catalog
Updated
--- _-= Per source details. Do not edit below this line.=-_ ## Source: kam193 (0d396ad34176d29956d695014d261847ada859c184d7a8e7820d96087af7eafe) Disguised as a system monitoring tool, the package delivers a Discord bot acting as an infostealer exfiltrating credentials, browser data, files and recording audio, screenshots and video. The code requires providing bot credentials, it is not functional
Affected
- PyPI sysdiagd1.2.1, 1.2.2, 1.2.3