--- title: OceanLotus suspected of distributing ZiChatBot malware... description: Kaspersky's GReAT team discovered a series of malicious Python wheel packages uploaded to PyPI starting July 2025, attributed with moderate confidence to the... canonical: https://daily.dev/posts/oceanlotus-suspected-of-distributing-zichatbot-malware-via-wheel-packages-in-pypi-gmynstd4t twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: OceanLotus suspected of distributing ZiChatBot malware via wheel packages in PyPI | daily.dev og:description: Kaspersky's GReAT team discovered a series of malicious Python wheel packages uploaded to PyPI starting July 2025, attributed with moderate confidence to the... og:url: https://daily.dev/posts/oceanlotus-suspected-of-distributing-zichatbot-malware-via-wheel-packages-in-pypi-gmynstd4t og:image: https://api.daily.dev/og/posts/gMYNStd4t.png og:image:alt: OceanLotus suspected of distributing ZiChatBot malware via wheel packages in PyPI og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # OceanLotus suspected of distributing ZiChatBot malware via wheel packages in PyPI **[Securelist](https://daily.dev/sources/securelist)** · 8 min read · 0 upvotes · 0 comments ## Summary Kaspersky's GReAT team discovered a series of malicious Python wheel packages uploaded to PyPI starting July 2025, attributed with moderate confidence to the OceanLotus APT group. Three fake packages — uuid32-utils, colorinal, and termncolor — acted as droppers for a previously unknown malware family called ZiChatBot, targeting both Windows and Linux. The infection chain extracts a DLL or .SO dropper from the wheel package, establishes persistence via registry (Windows) or crontab (Linux), then deploys ZiChatBot. Notably, ZiChatBot uses Zulip's public REST APIs as its C2 infrastructure instead of traditional dedicated servers, making detection harder. The malicious packages have since been removed from PyPI and the Zulip organization deactivated. No confirmed infections were observed. The campaign is consistent with OceanLotus's expanding supply chain attack strategy, following a similar GitHub-based phishing campaign in early 2025. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Malicious PyPI packages give hackers control of Telegram bot servers](https://daily.dev/posts/malicious-pypi-packages-give-hackers-control-of-telegram-bot-servers-gttlqffvq) · BleepingComputer · 0 upvotes · 0 comments - [Python package security in 2026](https://daily.dev/posts/python-package-security-in-2026-caqcr90if) · CSO Online · 0 upvotes · 0 comments - [11 Malicious NuGet Tools Pose as Game Cheats to Drop a Windo...](https://daily.dev/posts/11-malicious-nuget-tools-pose-as-game-cheats-to-drop-a-windo--rraw5qijj) · Socket · 0 upvotes · 0 comments - [Anthropic Incident: An AI Agent Published a Malicious Package to PyPI and 15 Real Systems Ran It](https://daily.dev/posts/anthropic-incident-an-ai-agent-published-a-malicious-package-to-pypi-and-15-real-systems-ran-it-qmvntl3xb) · StepSecurity · 0 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#python](https://daily.dev/tags/python), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/oceanlotus-suspected-of-distributing-zichatbot-malware-via-wheel-packages-in-pypi-gmynstd4t) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"OceanLotus suspected of distributing ZiChatBot malware via wheel packages in PyPI","url":"https://daily.dev/posts/oceanlotus-suspected-of-distributing-zichatbot-malware-via-wheel-packages-in-pypi-gmynstd4t","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/oceanlotus-suspected-of-distributing-zichatbot-malware-via-wheel-packages-in-pypi-gmynstd4t"},"datePublished":"2026-05-06T13:05:11.015Z","dateModified":"2026-05-06T13:05:44.283Z","description":"Kaspersky's GReAT team discovered a series of malicious Python wheel packages uploaded to PyPI starting July 2025, attributed with moderate confidence to the...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5b51716b7f16ab79afa54d42342cb60d?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5b51716b7f16ab79afa54d42342cb60d?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Securelist","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Securelist","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/e4b9f556af7a4e74a179787362dd5b07","url":"https://daily.dev/sources/securelist"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/oceanlotus-suspected-of-distributing-zichatbot-malware-via-wheel-packages-in-pypi-gmynstd4t","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,python,malware","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Securelist","item":"https://daily.dev/sources/securelist"},{"@type":"ListItem","position":3,"name":"OceanLotus suspected of distributing ZiChatBot malware via wheel packages in PyPI"}]} ```