Trojanized Native Extension Load (Miasma/Hades Campaign)

Ethan Andrews@eandrews

•updated Jun 8, 2026•3•0•10

Detects the loading of known trojanized native extensions (.abi3.so files) used in compromised bioinformatics PyPI packages (like ensmallen) as part of the Miasma/Hades campaign. Specifically targets 'ensmallen_haswell.abi3.so' and 'ensmallen_core2.abi3.so'.