CERT24MAL-2026-18298 — Malicious code in claudeopusfile (PyPI)
During installation, obfuscated code fetches code hidden in an image. The image contains a Python application with a native extension module. The module contains an obfuscated infostealer that collects sensitive data and exfiltrates it to a C2 server retrieved from transaction history in the Polygon blockchain.