TeamPCP Hides Stealer in WAV Files via Telnyx PyPI, Fake VS Code Alerts Target GitHub Devs, RedLine Admin Extradited, FBI Director Account Breach Claimed

Supply chain attackers TeamPCP evolve their tactics by hiding credential stealers inside WAV audio files on PyPI. A massive GitHub campaign uses fake VS Code security alerts to distribute malware to developers. The alleged RedLine infostealer administrator is extradited to the US. Pro-Iranian hackers claim they breached FBI Director Kash Patel's personal account. Plus: RSAC 2026 Conference highlights and Google sets a 2029 quantum-readiness deadline.

🎵 TeamPCP Supply Chain Attack: Credential Stealers Hidden in WAV Files

The threat actor TeamPCP — already responsible for supply chain attacks against Trivy, KICS, and litellm — has compromised the Telnyx Python SDK on PyPI, pushing two malicious versions that hide credential-stealing payloads inside .WAV audio files using steganography.

How the Attack Works

The malicious code is injected into telnyx/_client.py, activating the moment the package is imported. The attack uses a sophisticated three-stage chain:

• Stage 1 — Delivery: Audio steganography delivers the payload via a .WAV file downloaded from a command-and-control server
• Stage 2 — Execution: In-memory execution of a data harvester — no files written to disk
• Stage 3 — Exfiltration: Stolen credentials packaged as tpcp.tar.gz and sent via HTTP POST to 83.142.209[.]203:8080

Platform-Specific Behavior

The entire chain operates within a self-destructing temporary directory and leaves near-zero forensic artifacts on the host. Multiple security firms including Aikido, Endor Labs, JFrog, Socket, and StepSecurity have published independent analyses confirming the attack.

⚠️ Fake VS Code Security Alerts on GitHub Spread Malware to Developers

A large-scale, coordinated campaign is targeting developers across GitHub with fake Visual Studio Code security alerts posted in the Discussions section of thousands of repositories. Application security company Socket identified the operation as well-organized and automated rather than opportunistic.

Attack Mechanics

The threat actors create posts with realistic titles like "Severe Vulnerability — Immediate Update Required" that include fake CVE IDs and urgent language. In many cases, they impersonate real code maintainers or security researchers for legitimacy.

• Scale: Thousands of nearly identical posts across repositories, posted from newly created or low-activity accounts within minutes
• Delivery: GitHub Discussions trigger email notifications to participants and watchers, reaching developers' inboxes directly
• Payload link: Posts link to supposedly patched VS Code extensions hosted on Google Drive
• Redirection: A cookie-driven chain leads victims to a JS reconnaissance script that collects timezone, locale, user agent, OS details, and automation indicators
• Filtering: A traffic distribution system (TDS) profiles targets, filtering out bots and researchers before delivering the second stage

🏛️ Pro-Iranian Hackers Claim FBI Director Kash Patel Account Breach

A pro-Iranian hacking group has claimed responsibility for breaching FBI Director Kash Patel's personal account, announcing they are making emails and other documents from his account available for download.

This incident, if confirmed, would represent a significant escalation in foreign influence operations targeting senior US government officials. The compromise of a personal (non-government) account highlights the persistent risk that even the highest-ranking security officials face from targeted attacks on their personal digital footprint.

⚖️ Alleged RedLine Malware Administrator Extradited to the United States

Hambardzum Minasyan of Armenia has been extradited to the United States, accused of involvement in the development and administration of RedLine, one of the most prolific infostealer malware families of recent years.

RedLine has been responsible for stealing millions of credentials, financial data, and cryptocurrency wallet information from victims worldwide. The malware has been sold as a Malware-as-a-Service (MaaS) offering, making it accessible to a broad range of cybercriminals.

Why This Matters

• Scale of impact: RedLine-stolen credentials have fueled ransomware attacks, business email compromise schemes, and identity theft on a massive scale
• Law enforcement signal: The extradition demonstrates increasing international cooperation in pursuing malware developers, not just operators
• MaaS disruption: Taking down administrators of MaaS platforms has a multiplier effect, disrupting the entire customer base of cybercriminals who rely on the tool

📰 Rapid Roundup

RSAC 2026 Conference — Days 3-4 Highlights

The RSAC 2026 Conference continues with major vendor announcements across the cybersecurity landscape. Key themes include AI-powered security operations, zero trust architecture evolution, and the convergence of cloud-native security platforms. The conference reflects the industry's accelerating shift toward autonomous security capabilities and integrated risk management.

Google Sets 2029 Quantum Deadline

Google has set 2029 as the target year for organizations to be quantum-ready, signaling urgency in post-quantum cryptography migration. Organizations should begin auditing cryptographic dependencies and planning migration to quantum-resistant algorithms now — the transition will take years, not months.

Palo Alto Recruiter Scam

Threat actors are impersonating Palo Alto Networks recruiters in social engineering campaigns, leveraging the company's brand recognition to target cybersecurity professionals. A reminder that security practitioners are themselves high-value targets.

Anti-Deepfake Chip Development

New hardware-level approaches to combating deepfakes are emerging, with chip-based solutions that can verify content authenticity at the hardware level — a promising development as AI-generated media becomes increasingly indistinguishable from real content.

🛡️ Recommended Actions