Malicious code in artifact-lab-3-package-d7d52d45 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a252566eebeb4e8bc418b7ed0e585a4fee2602d921969b20b4075ec5df8d50fa Packages showing simple variants of revshell with targets to ngrok. Most probably experiments. Later versions moved to use Burp Collaborator to exfiltrate simp...

Malicious code in artifact-lab-3-package-b55680cd (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 be4896eebe0a6b7185d165cec1e593faea8a14a8b2386711ef9c08657273bb31 Packages showing simple variants of revshell with targets to ngrok. Most probably experiments. Later versions moved to use Burp Collaborator to exfiltrate simp...

MAL-2024-12192 Malicious code in artifact-lab-3-package (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0c18a16c7c21d93a8819aed298f6691835b1a31546ca573eb94ce4265d4fb291 Packages showing simple variants of revshell with targets to ngrok. Most probably experiments. Later versions moved to use Burp Collaborator to exfiltrate simp...

MAL-2024-11527 Malicious code in artifact-lab-3-package-b1ec2b9f (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3fe49cb6b5b199c213d54391901382790a3d9663bd90bf78361f07c594160fa6 Packages showing simple variants of revshell with targets to ngrok. Most probably experiments. Later versions moved to use Burp Collaborator to exfiltrate simp...

MAL-2024-12202 Malicious code in artifact-lab-3-package-b9485a2f (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 902094a9d90c1b9cc5eca3aa3d809929f664931dfa9feaea432bf85d205b06ed Packages showing simple variants of revshell with targets to ngrok. Most probably experiments. Later versions moved to use Burp Collaborator to exfiltrate simp...

Malicious code in jupiterhelper (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5a8e36ac6c995bb1a6fa9de762d459e8a108754dba767f6f3d19c385eb005b5e Once run, downloads and install from sleipnirbrowser.org a suspicious executable pretending to be a webbrowser. This website appears to be a scam using some ki...

Malicious code in jupiter-helper (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3649d8b83ed867b05ae6721bd1158879d8e6a13e0ea9d80c7b6bd9d028dd8738 Once run, downloads and install from sleipnirbrowser.org a suspicious executable pretending to be a webbrowser. This website appears to be a scam using some ki...

MAL-2024-12295 Malicious code in jupihelp (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7bb124c218cd3a0340ff934eafc0d4c9cbf322b2428d8a868ed28703aeb38426 Once run, downloads and install from sleipnirbrowser.org a suspicious executable pretending to be a webbrowser. This website appears to be a scam using some ki...

Malicious code in jupsolhelp (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1bc1615518392665ccc36d8c24a0e8e57ffce1147dfc8604c723513c28061743 Once run, downloads and install from sleipnirbrowser.org a suspicious executable pretending to be a webbrowser. This website appears to be a scam using some ki...

Malicious code in aiohttp-libscss (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d5cb2d30b1084d16cbffd08a377d8723d794f112d1d33e666a4d4154653015e0 Imitate legit package, when used, sends out the URL of web application using the package --- Category: MALICIOUS - The campaign has clearly malicious intent,...

Malicious code in ethercheck (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c202b40df14e5a6ba231853aefc190984e981a5f22ef90d3d2e3da641643e8dd During importing, the code attempts to decrypt data embeded in READMEs. The decrypted code is then used to download further remote scripts --- Category:...

MAL-2024-12264 Malicious code in ethercheck (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c202b40df14e5a6ba231853aefc190984e981a5f22ef90d3d2e3da641643e8dd During importing, the code attempts to decrypt data embeded in READMEs. The decrypted code is then used to download further remote scripts --- Category:...

Malicious code in netfetcher (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 dd65e46cc7d6457bd5a631526d3e5ffcb10a70befdf2d03c005c1e5acd235a34 --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2024-07-vaaai-netflixchecker Reasons based on the campaign: -...

Malicious code in pyfetcher (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4a689a2d20313b4d2681d50def7abed6ad72462be076e35056a6098556b1a246 --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2024-07-vaaai-netflixchecker Reasons based on the campaign: -...

Malicious code in crypt0graphyy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ec94110581ca3363bda748a7d59e0e82110dda02ec61092f85e7ef2d513f059e Package uses the template from https://github.com/thegoodhackertv/malpip to explore building malicious PyPI packages. --- Category: MALICIOUS - The campaign ha...

Malicious code in whee11 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 457eb762160a23e220ee51c7d26f0b143c534243c23027ae0ae39be72af55cdb Package uses the template from https://github.com/thegoodhackertv/malpip to explore building malicious PyPI packages. --- Category: MALICIOUS - The campaign ha...

Malicious code in gandon-pidar1 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4ac6e5875e2e378713032cdf0e35f5eef05d5f3967b4ec5e8c57759adb128b21 Package uses the template from https://github.com/thegoodhackertv/malpip to explore building malicious PyPI packages. --- Category: MALICIOUS - The campaign ha...

Malicious code in fsspecc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 90f4ad6035c504be5b282397b9a981d39fe71dcb0165be3b5d0571ac6274b51c Package uses the template from https://github.com/thegoodhackertv/malpip to explore building malicious PyPI packages. --- Category: MALICIOUS - The campaign ha...

Malicious code in s3ffs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 bcbd170ded254c386778d86dbd56a4d2fc5e7dfdeb37bd17fa2198e85e5c93c7 Package uses the template from https://github.com/thegoodhackertv/malpip to explore building malicious PyPI packages. --- Category: MALICIOUS - The campaign ha...

Malicious code in mecit2 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c9131eebc14bbebfb234f0f0c49ca47882df2140d1061d201735c360b866a867 Package uses the template from https://github.com/thegoodhackertv/malpip to explore building malicious PyPI packages. --- Category: MALICIOUS - The campaign ha...