PyPI Typosquat Delivers Multi-Layer Python RAT, Bypassing Scanners with XOR Encryption

A malicious Python package named spellcheckers has been uploaded to PyPI, impersonating the widely used pyspellchecker library, and has already been downloaded more than 950 times. HelixGuard describes a multi-layer encrypted backdoor hidden inside the package, designed to give attackers remote execution capabilities and full control over the victim’s host.

The initial infection occurs via a Base64-encoded hidden index file (ma_IN.index) that executes automatically, with the first-stage payload then downloading a second-stage backdoor from the attacker’s C2 at dothebest[.]store. The second-stage payload includes OS fingerprinting, computer name harvesting, custom packet construction, XOR-encrypted C2 communication, and continuous command polling, and can receive remote commands and execute attacker-controlled Python code via exec().

HelixGuard notes that the C2 addresses match ones previously used in social-engineering campaigns targeting cryptocurrency holders, linking this PyPI supply-chain attack to earlier operations. The malware uses multiple encryption layers, including XOR with a 16-byte key and a constant key 123, to bypass static scans and complicate analysis. 24 November 2025.