LOWSupply Chain
Global

Malicious PyPI packages give hackers control of Telegram bot servers

·Source: BleepingComputer

Updated:

Executive Summary

A campaign active since last November has been targeting Python developers building Telegram bots with trojanized Pyrogram forks that allow attackers to read arbitrary files on compromised servers. [...]

Analysis

A campaign active since last November has been targeting Python developers building Telegram bots with trojanized Pyrogram forks that allow attackers to read arbitrary files on compromised servers. [...]
Source Attribution

Originally published by BleepingComputer on Jun 30, 2026.

Related Threats

MEDIUMSupply Chain

Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector

Attackers can exploit LLM domain hallucinations through phantom squatting to target supply chains. Read the analysis to learn more. The post Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector appeared first on Unit 42 .

Unit 42 (Palo Alto)
MEDIUMSupply Chain

Aikido Buys Root for $70M to Automate Open-Source Patching

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/aikido-buys-root-for-70m-to-automate-open-source-patching-image_small-9-a-32118.jpg" align=right hspace=4><b>Deal Adds Hardened Packages, Automated CVE Fixes to Application Security Platform</b><br>Belgian software vendor Aikido Security acquired Boston-based Root for $70 million to embed automated vulnerability remediation into i

Bank Info Security
MEDIUMSupply Chain

Decades-Old Bash Tricks Expose AI Coding Agents to Supply Chain Attacks

Decades-old Bash shell tricks can bypass safeguards in most open source AI coding agents, potentially turning malicious repositories into supply chain attack vectors. The post Decades-Old Bash Tricks Expose AI Coding Agents to Supply Chain Attacks appeared first on SecurityWeek .

SecurityWeek