116 Malware Packages Discovered on PyPI Repository Infecting Home windows and Linux Methods

Dec 14, 2023NewsroomMalware / Provide Chain Assault

Cybersecurity researchers have recognized a set of 116 malicious packages on the Python Package deal Index (PyPI) repository which are designed to contaminate Home windows and Linux methods with a customized backdoor.

“In some instances, the ultimate payload is a variant of the notorious W4SP Stealer, or a easy clipboard monitor to steal cryptocurrency, or each,” ESET researchers Marc-Etienne M.Léveillé and Rene Holt stated in a report printed earlier this week.

The packages are estimated to have been downloaded over 10,000 occasions since Could 2023.

The risk actors behind the exercise have been noticed utilizing three strategies to bundle malicious code into Python packages, specifically through a check.py script, embedding PowerShell in setup.py file, and incorporating it in obfuscated kind within the __init__.py file.

Regardless of the tactic used, the tip objective of the marketing campaign is to compromise the focused host with malware, primarily a backdoor able to distant command execution, knowledge exfiltration, and taking screenshots. The backdoor module is carried out in Python for Home windows and in Go for Linux.

Alternately, the assault chains additionally culminate within the deployment of W4SP Stealer or a clipper malware designed to maintain shut tabs on a sufferer’s clipboard exercise and swapping the unique pockets tackle, if current, with an attacker-controlled tackle.

The event is the newest in a wave of compromised Python packages attackers have launched to poison the open-source ecosystem and distribute a medley of malware for provide chain assaults.

It is also the most recent addition to a gentle stream of bogus PyPI packages which have acted as a stealthy channel for distributing stealer malware. In Could 2023, ESET revealed one other cluster of libraries that have been engineered to propagate Sordeal Stealer, which borrows its options from W4SP Stealer.

Then, final month, malicious packages masquerading as seemingly innocuous obfuscation instruments have been discovered to deploy a stealer malware codenamed BlazeStealer.

“Python builders ought to completely vet the code they obtain, particularly checking for these strategies, earlier than putting in it on their methods,” the researchers cautioned.

The disclosure additionally follows the invention of npm packages that have been discovered focusing on an unnamed monetary establishment as a part of an “superior adversary simulation train.” The names of the modules, which contained an encrypted blob, have been withheld to guard the identification of the group.

“This decrypted payload accommodates an embedded binary that cleverly exfiltrates person credentials to a Microsoft Groups webhook that’s inner to the goal firm in query,” software program provide chain safety agency Phylum disclosed final week.