Cybercriminals have managed to once again smuggle a couple of malicious packages into the Python Package Index (PyPi), putting both Python developers, and users, at risk of data theft (opens in new tab).
The packages were discovered by cybersecurity researchers from Fortinet, who uncovered five seperate entities totaling just above 600 downloads.
The packages are called “3m-promo-gen-api”, “Ai-Solver-gen”, “hypixel-coins”, “httpxrequesterv2”, and “httpxrequester”, and seem to have been uploaded on January 27, being available for download for roughly two days before being removed.
Stealing sensitive data
The packages were designed to steal all sorts of sensitive information, including passwords saved in Chrome, Opera, Edge, Brave, and other browsers, authentication cookies for Discord, and wallet data for the Atomic Wallet and Exodus cryptocurrency wallets. Furthermore, the packages targeted a number of websites, in search of sensitive information, including Coinbase, Gmail, PayPal, eBay, and others.
The packages also look for certain keywords relating to banking, passwords, multi-factor authentication (MFA), and other sensitive information. If found, they’d steal them using the “transfer.sh” file transfer service.
While Fortinet’s researchers weren’t able to link the malicious packages to any existing infostealers, BleepingComputer claims that the attackers were actually distributing the W4SP stealer. This infostealer has allegedly become “heavily abused” in PyPI packages, the publication claims. Some of the keywords were in French, leading the researchers to believe that the attackers were of French origin.
PyPI is arguably the world’s most popular Python package repository, hosting more than 200,000 packages that developers can use to speed up their development process. As such, it’s a major target for cybercriminals, and news of infostealers being discovered in Python packages has been getting more frequent.
Most of the time, the attackers would impersonate a legitimate package, hoping that the developers would be too distracted, or lazy, to double-check the authenticity of the code they’re grabbing.
Via: BleepingComputer (opens in new tab)
English
Arabic
Belarusian
Bengali
Bosnian
Bulgarian
Chinese (Simplified)
Croatian
Czech
Danish
Dutch
Estonian
Filipino
Finnish
French
Georgian
German
Greek
Gujarati
Hausa
Hebrew
Hindi
Hmong
Hungarian
Igbo
Indonesian
Italian
Japanese
Javanese
Kazakh
Korean
Kurdish (Kurmanji)
Kyrgyz
Lao
Latvian
Lithuanian
Macedonian
Malagasy
Norwegian
Persian
Polish
Portuguese
Punjabi
Romanian
Russian
Serbian
Slovak
Slovenian
Spanish
Swedish
Thai
Turkish
Ukrainian
Vietnamese
Yoruba