Pierluigi Paganini November 18, 2022

A threat actor tracked as WASP is behind an ongoing supply chain attack targeting Python developers with the WASP Stealer.

Checkmarx researchers uncovered an ongoing supply chain attack conducted by a threat actor they tracked as WASP that is targeting Python developers.

The attackers are using Python packages to distribute a polymorphic malware called W4SP Stealer.

The malicious code is able to steal the victim’s Discord accounts, passwords, crypto wallets, credit cards, and other sensitive data on the victim’s PC. Stolen data have been sent them back to the attacker through a hard-coded Discord webhook address.

The threat actor is offering the WASP stealer for $20 claiming it is undetectable and is heavily “protected by some awesome obfuscation.” The supply chain attacks seem to be financially motivated.

Checkmarx investigation started from recent reports from Phylum and Check Point, which spotted tens of PyPI packages delivering the W4SP stealer to developers’ systems.

The researchers pointed out that the attacks stand out for the use of steganography to hide the polymorphic malware hidden within an image file hosted on Imgur.

Once a malicious package is installed, the setup.py script is executed, and additional Python packages are deployed on the victim’s system, including judyb, which provides steganography utilities.

The setup.py script downloads a .png image from Imgur and saves it in the operating system’s temp directory. Then the scripts uses the “lsb.reveal” function of the judyb package to extract the hidden code from the image.

After the installed code is executed, it fetches another piece of code from the URL “hxxp://misogyny[.]wtf/inject/UsRjS959Rqm4sPG4”.

The overall process ends with the W4SP Stealer (aka WASP Stealer) infection.

The analysis of the malicious code allowed the expert to find an open invitation to join the attacker’s Discord server managed by a single user that goes with the name of “Alpha.#0001”.

The attacker is creating many fake users to appear legitimate while stealing the profile description from popular user accounts.

The researchers analyzed the Discord server “WASP” and discovered that hundreds of victims have been infected by this campaign.

The same actor, recently started using a new username on PyPI (“halt”) to upload typosquatting libraries that leveraged the StarJacking technique (stealing the stars from another project).

“The level of manipulation used by software supply chain attackers is increasing as attackers get increasingly more clever.” concludes the report. “This is the first time seen polymorphic malware used in software supply chain attacks, and It seems we will experience even more attacks like this.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, WASP Stealer)

[adrotate banner=”5″]

[adrotate banner=”13″]