OceanLotus suspected of distributing ZiChatBot malware via wheel packages in PyPI

Reported 06 May 2026 by otx · Severity: medium

Between July 2025 and present, threat actors suspected to be OceanLotus distributed malicious wheel packages through PyPI targeting both Windows and Linux platforms. Three fake libraries (uuid32-utils, colorinal, and termncolor) were created to imitate legitimate packages, implem