Interestingly, in 6 (out of 9) of the PyPI modules containing this malware we found the same package metadata as in Discord Token Grabber, including email address, indicating that these samples were probably deployed by the same threat actor: It also avoidings execution in a debug environment. There is a legitimate asyncio module, as well as its legitimate backport asyncio37: the name of this malicious version is asyncio3.Ī bit more advanced than the Discord Token Grabber, this malware exfiltrates more data including browser’s cookies and login credentials. This sample shows how attackers abuse typosquatting. Like the previous malware family, this one is distributed without any obfuscation or code protection. There are a lot of Github repositories with cloned or slightly modified versions of original code. This is a quite popular and previously reported open source malware. Our monitoring system, aimed at fixing this blindspot, analyzed in a few days more packages than VirusTotal’s PyPi historical data.ħ9e0ed46f30b7b96e86ae356dee95a53343168d633e0d01c1b063981822bb529 We observed that VirusTotal’s historical visibility on PyPi’s packages was far from ideal. In this post we will share insights on PyPi’s suspicious libraries as well as take a closer look at particular campaigns abusing it. In some cases, malicious libraries implemented quite original features, like hijacking crypto wallet addresses in the victim’s clipboard. Generally speaking, the main target of these attacks appears to be the victim's environment data with a focus on browser’s cookies. In other cases, they uploaded completely fake packages consisting only of malicious code, such as the scappy library. In some cases, attackers poisoned well-known legitimate Python libraries and reuploaded them leveraging typosquatting, such as 'pylOpenSSL' mimicking pyOpenSSL. Any security breach or abuse could lead to a large-scale Supply Chain attack.ĭuring our monitoring we were able to identify dozens of suspicious packages, allegedly uploaded by threat actors trying to abuse PyPI.

PyPI took exceptional relevance amongst all repositories as, historically, it was trusted by default by many software developers. In late 2022 we decided to start monitoring PyPI, arguably the most important Python repository, as there were a number of reports on it hosting malware. AI boosts Code Language and File Format identifica.Actionable Threat Intel (II) - IoC Stream.

Inside of the WASP's nest: deep dive into PyPI-hos.

Threat hunting converting SIGMA to YARA.

Ip grabber bot for discord