360 Advanced Threat Research Institute attributes a multi-platform software supply chain campaign to APT-C-26, also known as Lazarus, using malicious PyPI packages to deliver payloads on Windows, Linux, and macOS. Windows packages decrypt DLL stages, run them through rundll32, drop OneDrive.pri and credential.sys, attempt persistence through scheduled tasks, registry keys, or startup folders, and load Comebacker to fetch later payloads. Linux and macOS packages use encoded Python to download oshelper or os_helper from attacker infrastructure such as pypi.online, arcashop.org, and jdkgradle.com, then communicate with C2 using custom HTTP parameters. The attribution is based on Comebacker use, PDB overlap with prior Lazarus npm activity, similar PyPI delivery patterns, and overlapping C2 infrastructure.