Search This Blog
Powered by Blogger.

Blog Archive

Labels

About Me

Load More
Trendy Right Now

Popular Posts

Showing posts with label python. Show all posts
python
Banana Squad Copycat CyberCrime Cyberhackers Cybersecurity GitHub Malicious Activities malware python

Malicious Copycat Repositories Emerge in Large Numbers on GitHub

 


The researchers at the National Cyber Security Agency have identified a sophisticated campaign that involved malicious actors uploading more than 67 deceptive repositories to GitHub, masquerading as legitimate Python-based security and hacking tools. 

In truth, these repositories actually serve as a vehicle through which trojanized payloads are injected into the system, thus compromising unsuspecting developers and security professionals. In a report by ReversingLabs under the codename Banana Squad, uncovered in 2023, that an earlier wave of attacks appeared to be an extension of that earlier wave, it appears that this operation is an extension of the earlier attack wave. 

During the previous campaign, counterfeit Python packages were distributed by the Python Package Index (PyPI) and were downloaded over 75,000 times and included the information-stealing capability that targeted Windows environments in particular. With their pivotal focus on GitHub, the attackers are taking advantage of the platform’s reputation as a trusted source for open-source software to make their malicious code more likely to infiltrate, thus expanding their malicious code’s reach. 

As a result of this evolving threat, it is becoming increasingly obvious that the software supply chain is facing persistent threats, and ensuring that packages and repositories are authenticated before they are integrated into development workflows is of utmost importance. Banana Squad was responsible for orchestrating the deployment of nearly 70 malicious repositories in its most recent operation, all carefully crafted to resemble genuine Python-based hacking utilities. 

It is important to note that the counterfeit repositories were designed in such a way that their names and file structures closely resembled those of reputable open-source projects already hosted on GitHub, giving them the appearance of being trustworthy at first glance. This group of hackers cleverly exploited a relatively overlooked feature of the GitHub code display interface in order to conceal their malicious intent further. 

There is a specific issue in which GitHub does not automatically wrap code lines on the next line if they exceed the width of the viewing window; rather, when the contents extend off the right edge of the screen indefinitely, GitHub will automatically wrap them onto the next line. This subtle quirk was tapped into by the attackers, who embedded a substantial stretch of empty space at the end of seemingly benign code lines, effectively pushing the malicious payload beyond the visible area of the code. 

Even when a diligent review of the code is conducted, it may not be possible to detect the hidden threat, unless the reviewer scrolls horizontally to the very end of each line, thus creating a blind spot for the concealed threat. Using this technique of obscuring software repositories and propagating malware under the guise of legitimate tools, threat actors are using an increasingly creative approach to evading detection and highlights the fact that they are using increasingly creative methods to evade detection. 

This Banana Squad activity does not represent an isolated incident. It is an excellent example of a broader trend in which cybercriminal groups are using GitHub to distribute malicious code in an increasing number of cases. It has become increasingly clear that threat actors are utilising the platform as a convenient delivery channel to reach out to a wide range of unaware developers and hobbyists over the past several months. 

The researchers at Trend Micro, for example, have recently discovered that 76 malicious projects have been attributed to the Water Curse group over the past few months. There was careful engineering involved in crafting these repositories so that they would deliver staged payloads that would harvest passwords, browser cookies, and other session data, as well as implement stealthy tools designed to enable persistent access to compromised computers. 

Another investigation by Check Point shed light on how the Stargazer's Ghost Network operated, a complex fraud scheme that relied on creating numerous fraudulent GitHub accounts to carry out its activities. A ghost profile was constructed by using stars, forks, and frequent updates, which mimicked the activity of legitimate developers, so that it appeared genuine, so that it would appear genuine to potential victims. This sophisticated ruse arose from the attackers' attempt to manipulate the popularity of their repositories to promote Java-based malware aimed at Minecraft players.

By doing so, they pushed the repositories to the top of GitHub's search rankings and made them more credible to potential users. According to research conducted by Check Point and Checkmarx, it appears that the Stargazer's Ghost Network is a small part of a larger underground ecosystem built around distribution-as-a-service models that may be the basis of much larger underground economies. It is essentially the same as renting out delivery infrastructure in mainstream organisations as they do in a cloud-based environment. 

As a result of their own research, Sophos analysts were able to confirm this perspective, revealing 133 compromised GitHub repositories which have been active since mid-2022. The malicious projects were capable of concealing harmful code in various forms, including Visual Studio build scripts, Python files that have been manipulated and JavaScript snippets that were used to manipulate screensavers. When the implants are executed, they can gather system information, capture screenshots, and launch notorious remote access trojans like Lumma Stealer, Remcos, and AsyncRAT.

Sophos also reported that operators often use Discord channels and YouTube tutorials to spread links to their repositories, typically offering quick game hacks or easy-to-use cyberattack tools as a means of spreading the word about the repositories. It has been proven to be a highly effective method of attracting novice users, who inadvertently compile and run malware on their machines, thereby turning themselves into unsuspecting victims of the very schemes they hoped to use.

Since GitHub is regarded as the world's leading platform for collaborating on open-source software, cybercriminals are naturally going to be interested in infiltrating these environments, as it is the world's largest hosting and collaboration platform for open-source software. In contrast to package registries such as npm or PyPI, people have historically preferred to adopt code from GitHub repositories to package registries for mass compromise because they are inherently more manual and require several deliberate steps in order to adopt the code. 

In order for a developer to be able to integrate a repository into their project, they must locate that repository, evaluate its credibility, clone it locally, and often perform a cursory code review during that process. These barriers create further barriers for attackers who wish to distribute malware across an extremely large range of networks by utilising source repository tools. 

In spite of this, the recent switch by groups like Banana Squad from traditional package registries to GitHub repositories may indicate a changing threat landscape shaped by stronger defensive measures that are being implemented within those registries. In the last two years, the majority of open-source ecosystems have made substantial security improvements to prevent malicious packages from spreading throughout their ecosystems. 

It is worth mentioning that Python Package Index (PyPI) recently implemented mandatory two-factor authentication (2FA) for all users of its system. As a result of these measures, ReversingLabs researchers are already experiencing measurable results. These measures are currently raising the bar for attackers seeking to hijack or impersonate trusted maintainers. 

In the opinion of Simons, one of the firm's principal analysts, the open-source community has become progressively more vigilant about scrutinising suspicious packages and reporting them. In today's society, adversaries are increasingly aware of the risks involved in sustaining malicious campaigns. As a result, they are finding it increasingly difficult to keep the campaigns going without being rapidly detected and removed. 

It is Simmons' contention that the combination of stricter platform policies, together with a more security-conscious user base, has resulted in a dramatic reduction in successful attacks. This trend has been supported by empirical evidence: According to ReversingLabs' report, malicious packages identified across npm, PyPI, and RubyGems declined by over 70% between 2023 and 2024. 

As a result of this decline in attacks, it is important to emphasize the progress that has been made within the package registry in regards to defensive initiatives; however, it is vital to also notice the adaptability of threat actors, who may now be shifting their focus to repositories where security controls and community vigilance aren't as robust as they used to be. 

Developers need to make sure that they exercise the same level of scrutiny when adopting code from repositories as they do when installing packages, since attackers continue to take advantage of any channel in their arsenal to spread their payloads across the Internet. In the future, the increased malicious activity against GitHub underscores an important point: as defenders strengthen security controls in one area of the software ecosystem, adversaries will invariably pivot to exploit the next weak spot in the software ecosystem. 

To achieve success in this dynamic, there needs to be a renewed commitment to embedding security as a shared responsibility rather than an afterthought across the open-source community. It is important for developers to adopt a security-in-depth approach that combines technical safeguards-such as cryptographic signatures, automated dependency scans, and sandboxed testing environments-with organisational practices emphasising the verification of sources and community trust signals in order to promote a defence-in-depth mindset. 

Platform providers must continue to invest in proactive threat hunting capabilities, improvements in detecting automated and manipulated accounts, and clearer mechanisms for users to evaluate the reputation and integrity of repositories when evaluating the provenance and integrity of data storage services. 

Educating contributors and maintaining users about the signs of tampering remains vitaltoo equip both novice contributors and experienced maintainers with the skills necessary to recognise subtle indications of tampering and deception, which remain crucial. It has become apparent that the open-source ecosystem is evolving.

Only a collaborative and adaptive approach, rooted in transparency, accountability, and constant vigilance, will be able to effectively blunt the effects of campaigns such as Banana Squad, thereby safeguarding the enormous value open-source innovation offers to individuals and organisations throughout the world.
Read more »
Software
Cyber Security IT Security JFrog Security malware python Software

New Malicious Python Package Found Stealing Cloud Credentials

 


A dangerous piece of malware has been discovered hidden inside a Python software package, raising serious concerns about the security of open-source tools often used by developers.

Security experts at JFrog recently found a harmful package uploaded to the Python Package Index (PyPI) – a popular online repository where developers share and download software components. This specific package, named chimera-sandbox-extensions, was designed to secretly collect sensitive information from developers, especially those working with cloud infrastructure.

The package was uploaded by a user going by the name chimerai and appears to target users of the Chimera sandbox— a platform used by developers for testing. Once installed, the package launches a chain of events that unfolds in multiple stages.

It starts with a function called check_update() which tries to contact a list of web domains generated using a special algorithm. Out of these, only one domain was found to be active at the time of analysis. This connection allows the malware to download a hidden tool that fetches an authentication token, which is then used to download a second, more harmful tool written in Python.

This second stage of the malware focuses on stealing valuable information. It attempts to gather data such as Git settings, CI/CD pipeline details, AWS access tokens, configuration files from tools like Zscaler and JAMF, and other system-level information. All of this stolen data is bundled into a structured file and sent back to a remote server controlled by the attackers.

According to JFrog’s research, the malware was likely designed to go even further, possibly launching a third phase of attack. However, researchers did not find evidence of this additional step in the version they analyzed.

After JFrog alerted the maintainers of PyPI, the malicious package was removed from the platform. However, the incident serves as a reminder of the growing complexity and danger of software supply chain attacks. Unlike basic infostealers, this malware showed signs of being deliberately crafted to infiltrate professional development environments.

Cybersecurity experts are urging development and IT security teams to stay alert. They recommend using multiple layers of protection, regularly reviewing third-party packages, and staying updated on new threats to avoid falling victim to such sophisticated attacks.

As open-source tools continue to be essential in software development, such incidents highlight the need for stronger checks and awareness across the development community.

Read more »
WebSockets
Blockchain codebase Credentials Crypto Cybersecurity dataexfiltration dependency devtools Firewall Gmail Hacking malware phishing PyPI python scripts SMTP Spoofing Threatactors WebSockets

Malicious PyPI Packages Exploit Gmail to Steal Sensitive Data

 

Cybersecurity researchers have uncovered a disturbing new tactic involving malicious PyPI packages that use Gmail to exfiltrate stolen data and communicate with threat actors. The discovery, made by security firm Socket, led to the removal of the infected packages from the Python Package Index (PyPI), although not before considerable damage had already occurred.

Socket reported identifying seven malicious packages on PyPI, some of which had been listed for more than four years. Collectively, these packages had been downloaded over 55,000 times. Most were spoofed versions of the legitimate "Coffin" package, with deceptive names such as Coffin-Codes-Pro, Coffin-Codes, NET2, Coffin-Codes-NET, Coffin-Codes-2022, Coffin2022, and Coffin-Grave. Another package was titled cfc-bsb.

According to the researchers, once installed, these packages would connect to Gmail using hardcoded credentials and initiate communication with a command-and-control (C2) server. They would then establish a WebSockets tunnel that leverages Gmail’s email server, allowing the traffic to bypass traditional firewalls and security systems.

This setup enabled attackers to remotely execute code, extract files, and gain unauthorized access to targeted systems.

Evidence suggests that the attackers were mainly targeting cryptocurrency assets. One of the email addresses used by the malware featured terms like “blockchain” and “bitcoin” — an indication of its intent.

“Coffin-Codes-Pro establishes a connection to Gmail’s SMTP server using hardcoded credentials, namely sphacoffin@gmail[.]com and a password,” the report says.
“It then sends a message to a second email address, blockchain[.]bitcoins2020@gmail[.]com politely and demurely signaling that the implant is working.”

Socket has issued a warning to all Python developers and users who may have installed these packages, advising them to remove the compromised libraries immediately, and rotate all sensitive credentials.

The researchers further advised developers to remain alert for suspicious outbound connections:

“especially SMTP traffic”, and warned them not to trust a package just because it was a few years old.
“To protect your codebase, always verify package authenticity by checking download counts, publisher history, and GitHub repository links,” they added.

“Regular dependency audits help catch unexpected or malicious packages early. Keep strict access controls on private keys, carefully limiting who can view or import them in development. Use isolated, dedicated environments when testing third-party scripts to contain potentially harmful code.”
Read more »
python
Blockchain cryptocurrency Cyber Attacks Cybersecurity GitHub Hacker JavaScript Linkedin malware python

North Korean Hacker Group Targets Cryptocurrency Developers via LinkedIn

 

A North Korean threat group known as Slow Pisces has launched a sophisticated cyberattack campaign, focusing on developers in the cryptocurrency industry through LinkedIn. Also referred to as TraderTraitor or Jade Sleet, the group impersonates recruiters offering legitimate job opportunities and coding challenges to deceive their targets. In reality, they deliver malicious Python and JavaScript code designed to compromise victims' systems.

This ongoing operation has led to massive cryptocurrency thefts. In 2023 alone, Slow Pisces was tied to cyber heists exceeding $1 billion. Notable incidents include a $1.5 billion breach at a Dubai exchange and a $308 million theft from a Japanese firm. The attackers typically initiate contact by sending PDFs containing job descriptions and later provide coding tasks hosted on GitHub. Although these repositories mimic authentic open-source projects, they are secretly altered to carry hidden malware.

As victims work on these assignments, they unknowingly execute malicious programs like RN Loader and RN Stealer on their devices. These infected projects resemble legitimate developer tools—for instance, Python repositories that claim to analyze stock market data but are actually designed to communicate with attacker-controlled servers.

The malware cleverly evades detection by using YAML deserialization techniques instead of commonly flagged functions like eval or exec. Once triggered, the loader fetches and runs additional malicious payloads directly in memory, making the infection harder to detect and eliminate.

One key malware component, RN Stealer, is built to extract sensitive information, including credentials, cloud configuration files, and SSH keys, especially from macOS systems. JavaScript-based versions of the malware behave similarly, leveraging the Embedded JavaScript templating engine to conceal harmful code. This code activates selectively based on IP addresses or browser signatures, targeting specific victims.

Forensic investigations revealed that the malware stores its code in hidden folders and uses HTTPS channels secured with custom tokens to communicate. However, experts were unable to fully recover the malicious JavaScript payload.

Both GitHub and LinkedIn have taken action against the threat.

"GitHub and LinkedIn removed these malicious accounts for violating our respective terms of service. Across our products, we use automated technology, combined with teams of investigation experts and member reporting, to combat bad actors and enforce terms of service. We continue to evolve and improve our processes and encourage our customers and members to report any suspicious activity," the companies said in a joint statement.

Given the increasing sophistication of these attacks, developers are urged to exercise caution when approached with remote job offers or coding tests. It is recommended to use robust antivirus solutions and execute unknown code within secure, sandboxed environments, particularly when working in the high-risk cryptocurrency sector.

Security experts advise using trusted integrated development environments (IDEs) equipped with built-in security features. Maintaining a vigilant and secure working setup can significantly lower the chances of falling victim to these state-sponsored cyberattacks.
Read more »
WooCommerce
Carding CyberCrime CyberSource Fraud malware PyPI python Security WooCommerce

Malicious PyPi Package ‘disgrasya’ Exploits WooCommerce Stores for Card Fraud, Downloaded Over 34,000 Times

 

A newly uncovered malicious Python package on PyPi, named ‘disgrasya’, has raised serious concerns after it was discovered exploiting WooCommerce-powered e-commerce sites to validate stolen credit card information. Before its removal, the package had been downloaded more than 34,000 times, signaling significant abuse within the developer ecosystem.

The tool specifically targeted WooCommerce sites using the CyberSource payment gateway, enabling threat actors to mass-test stolen credit card data obtained from dark web sources and data breaches. This process, known as carding, helps cybercriminals determine which cards are active and usable.

While PyPi has since removed the package, its high download count reveals the widespread exploitation of open-source platforms for illicit operations.

"Unlike typical supply chain attacks that rely on deception or typosquatting, disgrasya made no attempt to appear legitimate," explains a report by Socket researchers.

"It was openly malicious, abusing PyPI as a distribution channel to reach a wider audience of fraudsters."

What sets ‘disgrasya’ apart is the transparency of its malicious intent. Unlike other deceptive packages that mask their true purpose, this one openly advertised its illicit capabilities in the description:

"A utility for checking credit cards through multiple gateways using multi-threading and proxies."

According to Socket, version 7.36.9 of the package introduced the core malicious features, likely bypassing stricter checks typically applied to initial versions.

The malicious script mimics legitimate shopping behavior by accessing real WooCommerce stores, identifying product IDs, and adding items to the cart. It then proceeds to the checkout page, where it harvests the CSRF token and CyberSource’s capture context—sensitive data used to securely process card payments.

Socket explains that these tokens are typically short-lived and hidden, but the script captures them instantly while populating the form with fake customer details.

Instead of sending the card details directly to CyberSource, the data is routed to a malicious server (railgunmisaka.com) that impersonates the legitimate payment gateway. The server returns a fake token, which the script uses to complete the checkout process on the real store. If the transaction is successful, the card is validated; otherwise, it moves on to the next.

"This entire workflow—from harvesting product IDs and checkout tokens, to sending stolen card data to a malicious third party, and simulating a full checkout flow—is highly targeted and methodical," says Socket.

"It is designed to blend into normal traffic patterns, making detection incredibly difficult for traditional fraud detection systems."

This fully automated workflow makes it easier for attackers to validate thousands of cards at scale—cards which can then be used for financial fraud or sold on underground marketplaces.

Socket also warns that traditional fraud detection systems are ill-equipped to catch these types of attacks due to their highly realistic emulation of customer behavior.

Despite the sophistication of the operation, Socket researchers suggest some measures to reduce vulnerability:
  • Block very low-value transactions (typically under $5), often used in carding tests.
  • Monitor for high failure rates on small orders from the same IP address or geographic region.
  • Implement CAPTCHA verification during checkout flows to disrupt automated tools.
  • Apply rate limiting on checkout and payment endpoints to slow down or block suspicious behavior.
Read more »
python
Crypto Wallets Developers Ethereum malware PyPI python

Latest PyPi Malware Steals Ethereum Private Keys, Developers Targeted

Latest PyPi Malware Steals Ethereum Private Keys, Developers Targeted

Researchers at Socket have exposed a malicious PyPi (Python Package Index package), set-utils, that steals Ethereum private keys by abusing a “commonly used account creation functions.” 

Masked as a simple utility tool for Python sets, the package imitates commonly used libraries such as python-utils (712M+ downloads) and utils (23.5M+ downloads). The trap baits innocent developers into installing the malicious package, allowing hackers unauthorized entry to Ethereum wallets. 

Since the start of this year, set-utils has been downloaded over 1000 times, exposing Ethereum users and developers to risk. The package attacks people working with blockchain technology, especially developers using Python-based wallet management libraries like eth-account. 

The package hacks Ethereum account creation to steal private keys through the blockchain by exploiting https://rpc-amoy.polygon.technology/ as a Command and Control server (C2). This lets hackers retrieve stolen credentials covertly. 

PyPi Targets

PyPi targets Ethereum developers and businesses working with Python-based blockchain apps. These include:

  • Web3 apps and crypto exchanges integrating Ethereum transactions.
  • Users having personal Ethereum wallets via Python automation. 
  • Blockchain developers using the eth-account for wallet creation and handling.
  • People who installed the package may expose their private keys to hackers, causing major financial losses. 

Consequences of PyPi attack

  • Stealing Ethereum private keys: PyPi ties into standard wallet creation methods, which makes it difficult to notice.
  • Exploit of Polygon RPC (rpc-amoy.polygon.technology/) as a C2 channel: By not using traditional network extraction, hackers hide stolen data inside blockchain transactions, making it difficult to detect.
  • Hardcoded hacker-controlled RSA public key: The private keys are encrypted and then sent, hiding the data from basic monitoring. 
  • Permanent breach: Even if a user uninstalls set-utils, Ethereum wallets made “while it was active are already exposed and compromised.”

Controlling the damage

For mitigating risk, businesses and developers should implement robust measures to protect software supply chains. Routine dependency audits and using automated scanning software can help detect malicious or suspicious behaviours in third-party packages when they are incorporated into production environments. 

According to Socket, “Integrating these security measures into development workflows, organizations can significantly reduce the likelihood of supply chain attacks.”  Socket has notified the PyPI team, and “it was promptly removed to prevent further attacks.”

Read more »
Supply-chain
Cyber Attacks Cyber Hijack Cyber websites CyberCrime Cyberhackers JFrog Security malicious PyPI python Software Supply-chain

22,000 PyPI Packages Affected by Revival Hijack Supply-Chain Attack

 


It has been discovered that hackers can distribute malicious payloads easily and efficiently through the package repository on the PyPI website by using a simple and troublesome exploit. A JFrog security researcher has discovered a new supply chain attack technique using which they can attack PyPI repositories (Python Package Index) that can be used to hack them. 

Hundreds of thousands of software packages can potentially be affected by this attack technique and countless users could be affected as a result. A technique known as "Revival Hijack," exploits a policy loophole by which attackers may re-register the names of packages that have been removed from PyPI by their original developers and hijack the names themselves once the packages have been removed from PyPI. 

As part of an attack against the Python Package Index (PyPI) registry, a new supply chain attack technique has been uncovered in the wild, which is designed to infiltrate downstream organizations by exploiting the PyPI registry. There is an attack vector called "Revival Hijack" which involves the registration of a new project with a name that matches a package that has been removed from the PyPI platform which may then serve as an attack vector. 

If a threat actor manages to do this, then they will be able to distribute malicious code to developers who pull updates periodically. A software supply chain security firm named JFrog, which specializes in software supply chain security, has codenamed this attack method Revival Hijack, claiming to be able to hijack 22,000 existing PyPI packages, which in turn will result in hundreds of thousands of malicious packages being downloaded. 

There are more than 100,000 downloads or six months' worth of activity on the affected packages and are more susceptible to exploits. A very common technique used by Revival Hijack is to take advantage of the fact that victims are often unknowingly updating once-safe packages without being aware that they have been altered or compromised. Further, CI/CD machines are set up with a mechanism for automatically installing package updates so that they can be applied right away. 

A similar attack technique was discovered by Jfrog earlier this year, which is one of several different attacks that adversaries have been developing in recent years to try and sneak malware into enterprise environments using public code repositories like PyPI, npm, Maven Central, NuGet, and RubyGems, and to steal sensitive data. As a part of these attacks, popular repositories have often been cloned and infected, poisoning artifacts have been used, and leveraged leaked secrets such as private keys and database certificates have been revealed. 

According to JFrog researchers Brian Moussalli and Andrey Polkovnichenko, there is a much higher risk here than in previous software supply chain hacks that relied primarily on typosquatting and human error to distribute malicious code throughout software websites. When a developer decides to delete a project from PyPI, they are given a warning about the potential repercussions that may arise, including the Revival Hijack scenario that could occur. 

The dialogue warns that deleting this project will give the name of the project to anyone else who uses PyPI", so please refrain from doing so. In this scenario, the user will be able to issue new releases under the project name as long as the distribution files have not been renamed to match those from a previously released distribution. According to the motive of the attacker, the "Revival Hijack" attack vector can result in hundreds of thousands of increments as a result of the attack, depending on the motive. 

As far as exploiting this technique is concerned, it can be applied to exploiting abandoned package names to spread malware. Researchers observed this in action with the hijack of the "pingdomv3" package, which was detected by research teams. This package has been given the version number 0.0.0.1 to avoid a dependency confusion attack scenario, in which developer packages would be pulled by pip upgrade commands when they were run as a part of the upgrade process. 

In addition, it is worth noting that Revival Hijack has already been exploited in the wild, by an unknown threat actor called Jinnis who introduced a benign version of a package titled "pingdomv3" on March 30, 2024, just two days after the original package's owner (cheneyyan) removed it from PyPI. There has been a report that says the new developer has released an update containing a Base64-encoded payload, which checks for the presence of the "JENKINS_URL" environment variable, and if it exists, executes an unknown next-stage module retrieved from a remote server after checking for the appearance of the "JENKINS_URL." environment variable. 

Although JFrog proposed this precaution as a preventative measure, over the last three months it has received nearly 200,000 downloads both manually and automatically, proving that the Revival Hijack threat is very real, the security company announced. In making an analysis of this data, JFrog reported that there are outdated jobs and scripts out there that are still searching for the deleted packages, as well as users who manually downloaded these packages due to typosquatting. 

Depending on how the hijacked packages are hijacked, the adversaries may attach a high version number to each package, which will cause the CI/CD systems to automatically download the hijacked packages believing they are the latest version. This will ultimately cause a bug to develop, JFrog explained. As a result of the company's recommendation, PyPI has effectively prohibited the reuse of abandoned package names as well.

Some organizations use PyPI that need to be aware of this attack vector when updating to new versions of the package, JFrog warns. There is a non-public blacklist maintained by PyPI, which prevents certain names from being registered on new projects, but most deleted packages don't make it to that list because there is a non-public blacklist maintained by PyPI. It was due to this that the security firm took indirect measures to mitigate the "Revival Hijack" threat and added the most popular of the deleted and vulnerable packages to an account named security_holding under which they could be monitored. 

As a result of the researchers changing the version numbers of the abandoned packages to 0.0.0.1, they make sure that it does not affect active users while updating the packages. As a result, the package names are preserved and are not susceptible to theft by malicious actors who may want to use them for offensive purposes. The third month later, JFrog discovered that the packages in their repository seemed to have been downloaded by nearly 200,000 people due to automatic scripts or user errors. There are a lot more risks involved in "Revival Hijack" than the standard typosquatting attacks on PyPI. 

This is because users pulling updates for their selected projects for which they have permission do not make mistakes when doing so. It's best to mitigate this threat by utilizing package pinning to stay on a known secure version, verify the integrity of the package, audit its contents, and watch for any changes in package ownership or unusual updates.
Read more »
Social Engineering
Job Offer malware python Remote Access Trojan Social Engineering

North Korean Scammers Lure Developers with Fake Job Offers




A new cyber scam, dubbed "Dev Popper," is preying on software developers through fake job interviews. This elaborate ruse, masquerading as genuine employment opportunities, aims to infiltrate the victim's computer with a harmful Python backdoor, posing serious cyber threats.


How The Scam Operates?

In the multi-stage infection process employed by the "Dev Popper" cyber scam, the attackers orchestrate a sophisticated chain of events to deceive their targets gradually. It commences with the perpetrators posing as prospective employers, initiating contact with unsuspecting developers under the guise of offering job positions. As the sham interview progresses, candidates are coerced into executing seemingly innocuous tasks, such as downloading and executing code from a GitHub repository, all purportedly part of the standard coding assessment. However, unbeknownst to the victim, the innocuous-seeming code harbours hidden threats. These tasks, disguised as routine coding tests, are actually devised to exploit the developer's trust and gain unauthorised access to their system.


The Complex Attack Chain

Once the developer executes the provided code, a concealed JavaScript file springs into action. This file, leveraging commands, fetches another file from an external server. Within this file is a malicious Python script, ingeniously disguised as a legitimate component of the interview process. Once activated, the Python script surreptitiously collects vital system information and relays it back to the attackers. This multi-faceted approach, blending social engineering with technical deception, underscores the sophistication and danger posed by modern cyber threats.


Capabilities of the Python Backdoor

The Python backdoor, functioning as a Remote Access Trojan (RAT), boasts an array of intrusive capabilities. These include establishing persistent connections for continuous control, stealing files, executing commands remotely, and even secretly monitoring user activity by logging keystrokes and clipboard data.


The Rising Threat 

While the orchestrators behind "Dev Popper" remain elusive, the proliferation of fake job offers as a means for malware distribution is a growing concern. Exploiting the developer's reliance on job applications, this deceitful tactic once again forces us to realise the need for heightened vigilance among unsuspecting individuals.


How To Protect Yourself?

To mitigate the risk of falling victim to such cyber threats, it is imperative for developers and individuals to exercise caution and maintain awareness. When encountering job offers or unfamiliar requests for software-related tasks, verifying the legitimacy of the source and adopting a sceptical stance are crucial measures. 


Read more »
Subscribe to: Posts (Atom)