17/02/2025
PyPI suspends registrations amid malware attack
The Python Package Index (PyPI) has suspended new project creation and user registration to mitigate an ongoing malware upload campaign. This move comes as security researchers at Checkmarx uncovered a campaign involving multiple malicious packages related to the same threat actors.
The attackers are targeting victims through typosquatting attacks, tricking users into installing malicious Python packages through their command-line interface. This multi-stage attack aims to steal cryptocurrency wallets, sensitive browser data such as cookies and extension data, and various credentials.
The malicious payload also employs a persistence mechanism to survive system reboots, ensuring continued access to compromised machines.
Malicious typosquatting packages
Between 27-28 March 2024, several malicious Python packages were uploaded to PyPI—likely using automation tools. These packages contained malicious code within their setup.py files, enabling automatic ex*****on upon installation.
The setup.py files contained obfuscated and encrypted code using the Fernet encryption module. Upon installation, this code would execute, triggering the retrieval of an additional payload from a remote server. The payload URL was dynamically constructed by appending the package name as a query parameter.
Once decrypted, the retrieved payload revealed an extensive info-stealer designed to harvest sensitive information from the victim’s machine, including cryptocurrency wallets, browser data, and credentials.
