MAL-2026-17712Critical▾ Abyssal⚠ Exploited in the wildMalicious code in ig-gox (PyPI)
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 52.3 · likelihood 0 · exploitation 18
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
Importing ig_gox runs ig_gox/init.py, which decodes a blob (base64, XOR, zlib) after a few anti-debugging checks and execs it as main. The decoded loader only goes on if it looks like a physical Android device running Termux (it turns away x86, emulators and VMs), installs requests and cryptography if they are missing, downloads encrypted code from https://goxtools.shop/api/admin/storage.php, decrypts it with AES-256-CBC and runs it in memory. The README only calls it a runtime engine for Termux. I decoded the loader statically and did not see what the downloaded code does. I read 1.0.0 and did not run it.
-= Per source details. Do not edit below this line.=-
The pypi package ig-gox ships a top-level ig_gox/init.py that, on import (the README's documented usage), base64-decodes a ~5 KB embedded blob, XOR-decrypts it with a hardcoded key, zlib-decompresses it, HMAC-verifies it, then exec/compiles the resulting Python under name='main'. The visible wrapper has no other functionality; all actual behavior of the package is contained in that concealed blob. Before decoding, the module performs anti-analysis checks: it calls sys.exit(0) if sys.gettrace() returns a tracer, if the process environment/cwd/argv contain substrings such as 'uncompyle', 'pycdc', 'decompyle', 'deobfuscate', 'hook', or 'frida', and it tampers with references to builtins.exec/eval/compile. The combination of a hidden exec-of-decoded-payload reached automatically on import and explicit evasions against debuggers and decompilers is deliberate concealment of code execution from the installer and from reviewers.
Package hides obfuscated code aimed to avoid analysis and downloading the remote stage. The remote code is used to abuse Instagram service for mass fake account registration.
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-ig-gox
Reasons (based on the campaign):
The package contains code to detect if it is running in a sandbox environment.
obfuscation
Downloads and executes a remote malicious script.
abusing-3rd-api
ig-goxRefer to the advisory for the patched release.