The Python Package Index (PyPI) website is being used to launch sophisticated phishing campaigns targeting Python developers, highlighting the ongoing threats that open-source ecosystems face. The phishing campaign is utilising a counterfeit version of the website to target Python developers.
In an official advisory issued earlier this week by the Python Software Foundation (PSF), attackers have warned developers against defrauding them of their login credentials by using the official PyPI domain for their phishing campaign.
Despite the fact that PyPI's core infrastructure has not been compromised, the threat actors are distributing deceptive emails directing recipients to a fake website that closely resembles the official repository of PyPI. Because PyPI is the central repository for publishing and installing third-party Python libraries, this campaign poses a significant threat to developers' accounts as well as to the entire software supply chain as a whole.
In addition to using subtle visual deception, social engineering techniques are also used by attackers to craft phishing emails that appear convincingly legitimate to unsuspecting recipients of the emails. A subject line of the email normally reads "[PyPI] Email verification." These emails are typically sent to addresses harvested from the Python Package Index metadata of packages.
A noteworthy aspect of the spam emails is that they are coming from email addresses using the domain @pypj.org, a nearly identical spoof of the official @pypi.org domain—only one character in the spoof differs, where the legitimate “i” is replaced by a lowercase “j”.
To verify the authenticity of the email address, developers are asked to click a link provided in the email that directs them to a fake website that is meticulously designed to emulate the authentic PyPI interface in every way possible.
This phishing site takes the victims’ passwords and forwards them to PyPI's official website in a particularly deceptive way, effectively logging them in and masking the fact that they have been cheated, which leaves many unaware of the security breach.
As a result, PyPI maintainers have urged all users who have interacted with the fraudulent email to change their passwords as soon as possible and to review their "Security History" in order to look for unauthorised access signs.
Among the many examples of targeted deception within the developer ecosystem, threat actors have not only impersonated trusted platforms such as PyPI but also expanded their phishing campaigns to include developers of Firefox add-ons as part of a broader pattern of targeted deception. As part of the PyPI-focused attacks, developers are required to verify their email addresses by clicking on a link that takes them to a fake PyPI site that has an interface that is nearly identical to the legitimate PyPI site.
One of the most insidious aspects of this scam is the ability of the hacker to harvest login credentials and transmit them directly to PyPI's real site, thereby seamlessly logging in victims and concealing the breach. This clever redirection often leaves developers unaware that their credentials were compromised due to this clever redirection.
There have been several reports this week about phishing campaigns targeting Firefox extension developers, including a parallel phishing campaign that has been launched to target Firefox extension developers as well. The PyPI team has advised any affected users to change their passwords immediately and check the Security History section for any signs of unauthorised access.
Despite the fact that these emails falsely claim to originate from Mozilla or its Add-ons platform (AMO), they are instructing recipients to update their account details to maintain access to developer features. Upon closer examination, however, it is evident that these messages are not sophisticated at all: some of them are sent from generic Gmail accounts, and sometimes the word "Mozilla" is even misspelt, missing one letter from the “l” on some occasions.
As a result of these warnings, the exploitation of platform trust remains one of the most powerful ways in which developers can compromise their accounts across a wide range of ecosystems. As social engineering threats have increased across the software supply chain, the Python Software Foundation (PSF) and other ecosystem stewards continue to face increasingly sophisticated phishing and malware attacks regularly.
The PyPI Foundation has introduced a new feature known as Project Archival, which allows PyPI publishers to formally archive their projects, signalling to users that they will not be receiving any further updates shortly. In March 2024, PyPI was forced to temporarily suspend new user registrations as well as the creation of new projects due to a malware campaign in which hundreds of malicious packages disguised as legitimate tools were uploaded.
These efforts were soon tested by PyPI.
A response to the issue has been issued by PyPI, which has urged users to be vigilant by inspecting browser URLs carefully before logging in to their accounts and not clicking links from suspicious emails. It's interesting to note that similar attacks have also been aimed at the NPM registry recently. This time, however, they are using typosquatted domains-npnjs[.]com instead of npmjs[.]com-to send credential-stealing email verification messages to the registry.
Several npm packages were compromised as a result of that campaign, which were then weaponised to deliver malware dubbed Scavenger Stealer. With this malicious payload, sensitive data could be extracted from browsers, system information could be captured, and it could be exfiltrated through a WebSocket connection in order for it to be exfiltrated.
It has been documented that similar threats have been encountered across GitHub and other developer platforms, using a combination of typosquatting, impersonation, and reverse proxy phishing techniques. It is important to note that these attacks, despite appearing to be so simple to execute, are meant to compromise accounts that maintain widely used packages, which poses a systemic security risk.
For best results, security experts suggest that users verify domain names, use browser extensions that flag suspicious URLs, and use password managers with auto-fill that only allow for trusted domains in order to reduce the possibility of exposure. There has been an increase in phishing and typosquatting campaigns targeting software registries like PyPI, npm, and GitHub, which is indicative of a larger and more serious trend in exploiting developer trust by hacking.
In light of these incidents, developers, maintainers, and platform providers must establish enhanced security hygiene measures. Even though open-source ecosystems continue to serve as the foundation for modern software infrastructure, it is clear that the consequences of compromised developer accounts are no longer limited to individual projects. They are now threatening the integrity of the global software supply chain as a whole.
Developers must take proactive measures in light of this shifting landscape by treating unexpected account verification requests with scepticism, verifying domain identity character by character, and implementing multi-layered security safeguards such as two-factor authentication and password managers that are security-conscious.
A push is also being made for platform operators to accelerate investment in the detection of threats, communication transparency, and education of their users. Ultimately, the community will be able to defend itself against these low-tech, but highly impactful, attacks by recognising deception before it can cause damage.
The sophistication of threat actors is allowing them to exploit familiarity and automation to their advantage, making security the first principle to be put forward across the development ecosystem to ensure resilience to attacks.
