Home Security PyPI Repository Warns Python Mission Maintainers About Ongoing Phishing Assaults

PyPI Repository Warns Python Mission Maintainers About Ongoing Phishing Assaults

by crpt os


The Python Package Index, PyPI, on Wednesday sounded the alarm about an ongoing phishing campaign that aims to steal developer credentials and inject malicious updates to legitimate packages.

“This is the first known phishing attack against PyPI,” the maintainers of the official third-party software repository said in a series of tweets.

The social engineering attack entails sending security-themed messages that create a false sense of urgency by informing recipients that Google is implementing a mandatory validation process on all packages and that they need to click on a link to complete the validation before September, or risk getting their PyPI modules removed.

PyPI Repository Phishing Attack

Should an unsuspecting developer fall for the scheme, users are directed to a lookalike landing page that mimics PyPI’s login page and is hosted on Google Sites, from where the entered credentials are captured and abused to unauthorizedly access the accounts and compromise the packages to include malware.

CyberSecurity

The modifications, for their part, are designed to download a file from a remote server. “This malware is untypically large, ~63MB, (possibly in an attempt to evade [antivirus] detection) and has a valid signature (signed on August 23rd, 2022),” Checkmarx researcher Aviad Gershon noted.

“These releases have been removed from PyPI and the maintainer accounts have been temporarily frozen,” PyPI said. Two of the affected packages so far include “exotel” and “spam.” Additionally, several hundred typosquats are said to have been removed.

PyPI Repository Phishing Attack

PyPI also said it’s actively monitoring reports of new rogue packages and ensuring their removal. Developers who believe they may have been compromised should reset their passwords with immediate effect, reset 2FA recovery codes, and review PyPI account logs for anomalous activity.

The phishing attack is yet another sign of how the open source ecosystem is increasingly at risk from threat actors, who are capitalizing on libraries and projects that are woven into the fabric of several applications to mount supply chain attacks that can have cascading effects.

CyberSecurity

Earlier this month, researchers from Checkmarx disclosed two malicious Python packages – typing-unions and aiogram-types – that impersonated popular packages typing and aiogram to trick developers into downloading them and infecting their machines with Cobalt Strike.

Another large-scale attack involved a threat actor publishing a dozen typosquatted packages under the names of popular projects with slight permutations to install a multi-stage persistent malware on compromised systems.

The development also arrived over two months after the registry began imposing a mandatory two-factor authentication (2FA) requirement for projects deemed “critical.”





Source link

Related Articles

xxxanti beeztube.mobi hot sexy mp4 menyoujan hentaitgp.net jason voorhees hentai indian soft core chupatube.net youjzz ez2 may 8 2023 pinoycinema.org ahensya ng pamahalaan pakistani chut ki chudai pimpmovs.com www xvedio dost ke papa zztube.mobi 300mbfilms.in صور مص الزب arabporna.net نهر العطش لمن تشعر بالحرمان movierulz plz.in bustyporntube.info how to make rangoli video 穂高ゆうき simozo.net 四十路五十路 ロシアav javvideos.net 君島みお 無修正 افلام سكس في المطبخ annarivas.net فيلم سكس قديم rashmi hot videos porncorn.info audiosexstories b grade latest nesaporn.pro high school girls sex videos real life cam eroebony.info painfull porn exbii adult pics teacherporntrends.com nepali school sex