- Socket found seven malicious packages on pypi
- The packages abused Gmail and WebSocket
- They were removed from the platform
Several malicious Pypi packages were recently observed abuse of Gmail to exfilter stolen sensitive data and communicate with their operators.
The CyberSecurity Researchers Socket, which found the packages, reported them to the Python archive and thus helped them get them removed from the platform – but the damage has already been done.
According to Socket, there were seven malicious pypi packages, some of which sat on the platform for more than four years. Cumulatively, they had more than 55,000 downloads. Most are an imitation of the legitimate coffin package with names such as Coffin-Codes-Pro, Coffin-Codes, Net2, Coffin-Codes-Net, Coffin-Codes-20122, Coffin2022 and Coffin-Grave. One was called CFC BSB.
Compromised hosting accounts
The researchers explained that when the package is installed on the victim unit, it creates that connection to Gmail using hard -coded credentials and contacts the C2 server.
Then it creates a tunnel using Websockets, and as Gmail’s E -Mail server is used for communication, communication bypasses most firewalls and other security measures.
As a result, attackers are able to send commands, steal files, run code and even access systems externally.
However, it seems that the villains were mostly interested in cryptot theft when one of the e -mail addresses that malware reached had the words “Blockchain” and “Bitcoin” it it:
“Coffin-Codes-Pro establishes a connection to Gmail’s SMTP server using hard-coded credentials, namely sphacoffin@gmail[.]Comand a password, ”says the report.
“It then sends a message to another E -Mail address, Blockchain[.]Bitcoins2020@gmail[.]Com polite and descending signaling that the implant is working. “
Socket has warned all Python users who run any of the packages in their environment to remove them immediately and rotate keys and credentials as needed.
The researchers also encouraged everyone to look for unusual outgoing connections, “especially SMTP traffic,” and warned them not to rely on a package just because it was a few years old.
“To protect your code base, always verify the authenticity of the package by checking download counts, publishing history and github repository links,” they added.
“Regular addiction audits help catch unexpected or malicious packages early. Keep strict access controls on private keys, and carefully limit who can see or import them in development. Use isolated, dedicated environments when testing third -party scripts to contain potentially harmful code.”
Via Bleeping computer
