ZiChatBot Malware: PyPI Supply Chain Attack Exploits Zulip APIs, Hits Windows and Linux

The recent discovery of ZiChatBot malware marks a significant escalation in the sophistication and reach of software supply chain attacks. Distributed through the Python Package Index (PyPI) and leveraging the APIs of the open-source chat platform Zulip for command and control, ZiChatBot has successfully infiltrated both Windows and Linux systems. This incident not only exposes critical vulnerabilities in the software development ecosystem but also signals a strategic shift in attacker methodologies—one that targets the very infrastructure trusted by developers and enterprises worldwide.

Dissecting the ZiChatBot Attack: Anatomy and Tactics

According to Kaspersky, ZiChatBot was embedded in three malicious PyPI packages—uuid32-utils (1,479 downloads), colorinal (614 downloads), and termncolor (387 downloads)—all uploaded during a brief window between July 16 and 22, 2025. These packages masqueraded as legitimate utilities, even implementing the features described on their PyPI pages, which enabled them to evade cursory scrutiny by both users and some automated security tools. Notably, termncolor appeared benign but listed colorinal as a dependency, facilitating indirect infection.

Upon installation, the packages deployed platform-specific droppers: on Windows, a DLL dropper named terminate.dll was written to disk, loaded upon library import, and registered for persistence via the Windows Registry. The dropper then deleted itself to minimize forensic traces. On Linux, a shared object dropper (terminate.so) was placed in /tmp/obsHub/obs-check-update and set to execute via a crontab entry. In both cases, the dropper facilitated the installation of the ZiChatBot malware, which then established communication with its operators.

Innovative Use of Zulip APIs as Command and Control

What sets ZiChatBot apart from many previous malware campaigns is its use of Zulip's public REST APIs as a covert command-and-control (C2) channel. Rather than relying on a dedicated C2 server—which can be more easily identified and blocked—ZiChatBot blends its traffic with legitimate communications on a popular open-source chat platform. This approach complicates detection, as security teams may be less likely to scrutinize traffic to widely used SaaS or open-source collaboration tools.

ZiChatBot executes shellcode received via Zulip API messages and signals successful execution by sending a heart emoji back to the server. This subtle feedback mechanism enables attackers to maintain tight operational control without raising immediate red flags in network monitoring tools. The campaign demonstrates a growing trend: attackers are increasingly abusing legitimate cloud-based and SaaS APIs to mask malicious activity, making traditional network-based detection less effective.

Cross-Platform Reach: Expanding the Attack Surface

The ability of ZiChatBot to target both Windows and Linux systems is particularly alarming. By developing platform-specific droppers and leveraging Python's cross-platform nature, the attackers maximized their reach into diverse environments. This is especially relevant for organizations with heterogeneous IT estates, such as research institutions, cloud service providers, and enterprises with mixed infrastructure. The campaign's success in achieving hundreds to over a thousand downloads before discovery underscores the scale and stealth of the operation.

Historically, supply chain attacks have often focused on a single operating system or ecosystem. ZiChatBot's cross-platform design signals a maturing threat landscape, where attackers invest in broader compatibility to maximize impact and evade detection by targeting less-monitored systems.

Supply Chain Security: PyPI as a High-Value Target

This incident is the latest in a series of attacks exploiting open-source package repositories. PyPI, as the default package manager for Python, is a critical component in the global software supply chain. Its openness and ease of contribution, while fostering innovation, also create opportunities for malicious actors to introduce poisoned packages. The fact that the malicious packages implemented their advertised features further complicates automated vetting, as basic functionality checks may not reveal hidden payloads.

According to Kaspersky, the attack was "carefully planned and executed," with the malicious packages being swiftly removed after discovery. However, the incident reveals systemic weaknesses: the lack of mandatory code reviews, limited package provenance tracking, and insufficient runtime behavioral analysis in many package ecosystems. As open-source dependencies proliferate in enterprise software, the risk of downstream compromise grows exponentially.

Attribution and Threat Actor Analysis

While the precise identity of the attackers remains unconfirmed, Kaspersky noted a 64% code similarity between the ZiChatBot dropper and malware previously attributed to OceanLotus (APT32), a Vietnam-aligned advanced persistent threat group. OceanLotus has a documented history of targeting Chinese cybersecurity professionals and leveraging supply chain vectors, including poisoned Visual Studio Code projects distributed as Cobalt Strike plugin lookalikes. In those campaigns, the group used the Notion note-taking service as a C2 channel, indicating a pattern of abusing legitimate SaaS platforms for covert operations.

If OceanLotus is indeed behind ZiChatBot, this campaign represents a strategic expansion of their targeting scope and technical sophistication. It also signals a broader trend among state-aligned actors to diversify initial access vectors beyond phishing, increasingly favoring supply chain and developer ecosystem attacks that offer both scale and stealth.

Enterprise and Developer Implications

For enterprises, the ZiChatBot incident is a wake-up call to the operational risks posed by third-party dependencies. Even well-maintained development environments can be compromised by a single malicious package, especially when attackers mimic legitimate functionality and exploit trusted APIs. Organizations must therefore move beyond perimeter defenses and adopt a "zero trust" approach to software sourcing and execution.

Recommended mitigations include:

Implementing automated dependency scanning and runtime behavioral analysis for all third-party packages.
Enforcing strict provenance and signature verification for critical dependencies.
Regularly auditing installed packages and monitoring for anomalous network activity, especially to SaaS APIs not typically used in production workflows.
Educating developers about the risks of supply chain attacks and encouraging the use of vetted, well-maintained packages.

For the open-source community, this incident highlights the urgent need for enhanced package repository security—such as mandatory multi-factor authentication for publishers, automated code similarity analysis to flag suspicious uploads, and community-driven review processes.

Strategic Outlook: The Future of Supply Chain Threats

ZiChatBot's use of a mainstream chat API for C2, its cross-platform payloads, and its sophisticated delivery via PyPI all point to a future where supply chain attacks become more frequent, stealthy, and damaging. As attackers continue to innovate, defenders must anticipate not just technical exploits, but also the creative abuse of legitimate infrastructure. The increasing convergence of developer tools, open-source ecosystems, and cloud APIs creates a complex attack surface that demands equally sophisticated defense-in-depth strategies.

One non-obvious implication is the potential for attackers to chain together multiple SaaS and open-source APIs—creating resilient, multi-hop C2 channels that are even harder to detect and disrupt. This could force security teams to rethink their monitoring strategies, placing greater emphasis on behavioral analytics and anomaly detection across both internal and external communications.

What Happens Next: Industry Response and Long-Term Solutions

In the wake of the ZiChatBot incident, expect to see increased scrutiny of open-source package repositories by both security vendors and regulatory bodies. Some likely developments include:

Stronger collaboration between repository maintainers, security researchers, and enterprise consumers to share threat intelligence and rapidly remove malicious packages.
Adoption of advanced static and dynamic analysis tools by repositories to detect hidden payloads and suspicious code reuse.
Greater pressure on SaaS providers to monitor for and disrupt abuse of their APIs as covert C2 channels.

Ultimately, the ZiChatBot campaign is a signal that the software supply chain is now a primary battleground in cybersecurity. Organizations that fail to adapt their defenses to this reality risk not only operational disruption but also reputational and regulatory consequences. As supply chain threats continue to evolve, so too must the strategies and tools used to defend against them.

Sources: Kaspersky, The Hacker News, ThreatBook