GCVE-110-OSM-2026-13486

Malicious PyPI package that activates on import and uses anti-analysis and Android/Termux environment checks before retrieving and executing an encrypted, server-controlled Python payload entirely in memory. The final remote stage remains unavailable for analysis. Importing ig_gox immediately runs anti-debugging and anti-hook checks, verifies an embedded encrypted blob with HMAC-SHA256, XOR-decrypts and zlib-decompresses an embedded loader, and executes it as __main__. The recovered loader rejects desktop systems, x86 Android environments, and numerous emulator signatures. It may silently install Python and Termux dependencies, then performs an authenticated HTTP GET for a Base64-encoded remote payload. That response is decrypted using a hard-coded AES-256-CBC key, unpadded, zlib-decompressed, compiled, and executed in memory. A requests-based download path and urllib fallback are present, and both may follow server redirects. An optional but disabled licensing branch derives a device HWID from Android identifiers and model information and submits its SHA-256 digest to the licensing backend. No persistence or explicit payload file drop was found in the available stages. The dynamically served final Python stage is unresolved and may contain additional downloads, persistence, credential theft, service abuse, or exfiltration behavior.