GCVE-110-OSM-2026-10765

During import, the code obfuscated in native extension downloads malicious remote executable and establishes persistence via registry keys. Downloaded binary seems to be used for cryptomining. Attacker infrastructure corresponds with the campaign 2026-07-pyqt6darktheme. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-08-libasync Reasons (based on the campaign): - Downloads and executes a remote executable. - obfuscation - The package contains code to detect if it is running in a sandbox environment. - native-extension - persistence - cryptominer Judge assessment: This looks like a native-extension loader with clear attacker intent: the .pyd contains injection APIs (`VirtualAlloc`, `VirtualProtect`) plus anti-analysis (`IsDebuggerPresent`), which is consistent with unpacking and executing a payload rather than normal library behavior. The OSV advisory claims a remote executable download and registry-based persistence, and the binary indicators here strongly corroborate a malware installer/dropper model for a third-party package named `libasync` with minimal metadata. The likely attacker model is a compromised or burner PyPI package used to deliver a cryptomining loader while evading analysis; the static evidence is strong enough to treat this as malicious. ADDITIONAL FINDINGS - Binary: Injection in libasync/libasync.pyd: "VirtualAlloc" - Binary: Anti Analysis in libasync/libasync.pyd: "IsDebuggerPresent" PAYLOAD FILES libasync/libasync.pyd