Microsoft: Mistral AI Software Package Infected with Malicious Code, Stealing Developer Credentials

According to Decrypt, Microsoft's Threat Intelligence team reported that attackers embedded malicious code into software packages distributed by Mistral AI via PyPI. When developers use this software on Linux systems, the malicious code automatically executes, downloading a malicious file named `transformers.pyz` from a remote server and running it in the background. The file name is deliberately designed to mimic the widely-used Hugging Face Transformers library. Microsoft stated that the malware primarily steals developer login credentials and access tokens, avoids systems using Russian language settings, and may randomly delete files on systems located in Israel or Iran. This attack is linked to the "Shai-Hulud" supply chain malware attacks that began in September.