Backdoor implant discovered on PyPI posing as debugging utility

ReversingLabs discovered a malicious PyPI campaign delivering backdoors via packages (dbgpkg, requestsdev and related discordpydebug) that wrap callable functions from requests and socket modules to execute a payload on use; the payload retrieves a public key, installs the Global Socket Toolkit to bypass network controls, and exfiltrates encrypted connection secrets. The technique enabled long‑lasting stealthy access, and RL notes similarities to prior campaigns attributed to the Phoenix Hyena/DumpForums hacktivist group, though attribution remains tentative.