A supply chain campaign dubbed 'Operation Navy Ghost' has been targeting Python developers building Telegram bots since November 2025. Eight trojanized forks of the popular Pyrogram library were published on PyPI, collectively accumulating over 25,000 downloads. Each package contains a hidden backdoor (secret.py) that registers covert Telegram command handlers, allowing attackers to execute arbitrary Python code or shell commands on victim servers, read any file, dump credentials, and access databases. The backdoor activates only on Telegram bot accounts in production environments and is controlled via a hardcoded list of attacker Telegram IDs. Checkmarx, which discovered the campaign, attributes all packages to a single threat actor based on shared infrastructure and identical backdoor code. Affected developers should remove the packages, rotate all credentials, and revoke Telegram bot tokens.
