Phishing Campaign against PyPI

PyPI, has warned of an ongoing phishing campaign that aims to steal developer credentials and inject malicious updates to the packages in the repository.

The phishing messages are designed to trick recipients into clicking on a link to be compliant with a new Google mandatory validation process on all packages. Recipients are urged to complete the validation procedure by September, to avoid the removal of their packages from PyPI.

Advertisements

Once clicking the link, users are directed to a landing page that mimics PyPI’s login page and is hosted on Google Sites. Once the attackers obtained the user account credentials, they were able to push malicious updates to legitimate packages.

The malicious packages employed in this campaign are trying to download and execute a file from the URL

hxxps://python-release[.]com/python-install.scr.

During discovery, the packages had a low detection, the malicious code is digitally signed and is untypically large in an attempt to evade AV detection.

The researchers also found another domain related to this attacker’s infrastructure, “ledgdown[.]com”, registered under the same IP. This domain poses as a legitimate website of the crypto assets app “ledger live.”

Following the phishing attack, PyPI said it’s revising its eligibility requirements for the hardware security key program. Any maintainer of a critical project, regardless of whether they already have TOTP-based 2FA enabled, is now eligible.