Hackers Backdoor Telnyx Python SDK on PyPI to Steal Cloud and Dev Credentials

TeamPCP (linked to TeamTNT) uploaded two trojanized Telnyx Python SDK releases (4.87.1 and 4.87.2) to PyPI; the malicious modification to _client.py executed on import, fetched payloads hidden inside WAV files via steganography, and deployed a cross-platform credential harvester that persisted (e.g., msbuild.exe, sysmon.service), encrypted stolen secrets with AES-256-CBC/RSA-4096, and exfiltrated data to C2 infrastructure (notably 83.142.209.203:8080) using identifiable headers (X-Filename:tpcp.tar.gz); the packages were live for ~4 hours and the report provides IOCs and remediation steps including rotation of all exposed credentials and blocking the attacker subnet.