Experts warn of the first known phishing attack against PyPI

The Python Package Index (PyPI) warns of an ongoing phishing campaign to steal developer credentials and distribute malicious updates.

The Python Package Index, PyPI, this week warned of an ongoing phishing campaign that aims to steal developer credentials and inject malicious updates to the packages in the repository.

“Today we received reports of a phishing campaign targeting PyPI users. This is the first known phishing attack against PyPI.” states the warning.

The phishing messages are designed to trick recipients into clicking on a link to be compliant with a new Google mandatory validation process on all packages. Recipients are urged to complete the validation procedure by September, to avoid the removal of their packages from PyPI.

Upon clicking on the link, users are directed to a landing page that mimics PyPI’s login page and is hosted on Google Sites.

Once the attackers obtained the user account credentials, they were able to push malicious updates to legitimate packages.

According to Checkmarx researcher Aviad Gershon first known phishing campaign targeting PyPI Users, the researchers are aware of hundreds of malicious packages that were part of this attack.

“The phishing attempt and the malicious packages are linked by the domain linkedopports[.]com, which appears in the malicious package code and also functions as the location to which the phishing site tries to send the stolen credentials.” reads the analysis published by Checkmarx.

The malicious packages employed in this campaign are trying to download and execute a file from the URL hxxps://python-release[.]com/python-install.scr.

At the time of the discovery, the packages had a low detection, the malicious code is digitally signed and is untypically large (~63MB) in an attempt to evade AV detection).

The researchers also found another domain related to this attacker’s infrastructure, “ledgdown[.]com”, registered under the same IP. This domain poses as a legitimate website of the crypto assets app “ledger live.”

“This is another step in the attacks against open source packages and open source contributors.” concludes the post. “We recommend checking your network traffic against the IOCs listed below and as always, encouraging contributors to use 2FA.”

Update: Following the phishing attack, PyPI said it’s revising its eligibility requirements for the hardware security key program. “Any maintainer of a critical project, regardless of whether they already have TOTP-based 2FA enabled, is now eligible,” it noted.

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, PyPI)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.