jossefharush

An attacker published a total of 444 malicious packages via 22 different PyPi user accounts. The malicious packages infect the victim’s web browser with a hidden extension that manipulates the clipboard and change the value of a copied crypto wallet address to match the attacker’s crypto wallet address.

same attacker targeting users via phishing emails and malicious typosquatting packages downloading malware

My team discovered today an attack on the Python ecosystem with multi-stage persistent malware

We instantly started researching and saw the PyPi user account devfather777 published a dozen malicious Typosquatting packages under the names of popular projects with slight permutation.

All malicious packages contain code executed upon installation and downloads custom made C++ malware hosted on the GitHub repository jagermager999/8746465cdg78cdsxasy8a with interesting capabilities

Findings were reported to the security teams of PyPi and GitHub

The attacker created a copy of the highly popular "requests" package with all kind of typosquatting permutations, preserved the original functionality to stay under the radar and added a cryptominer surprise!!