MAL-2024-11577 Malicious code in discordmessager (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 119a7015f090394365981291b03c6f5855b4dfd33da674c238c0c4323063a32a During installation, a remote, highly obfuscated script is downloaded and executed. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in crypto-regex-checker (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a849790638e062a67e51026ebcd7d23b06a5cb901a1b74ce74bcf09762511538 Inside the library there is a part running code hidden in the attached image, which then exfiltrate user-provided data, downloads and install next stage code,...

Malicious code in ua-agent-generator (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7294a5078d47d2797cf31931252b823374b648a48534bc14b59cd73195cfe2f1 Inside the library there is a part running code hidden in the attached image, which then exfiltrate user-provided data, downloads and install next stage code,...

Malicious code in user-rand-agnt-user (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e5b1f023c010c55afb11b349054c1180303197e0d411176b276d26574d891702 Inside the library there is a part running code hidden in the attached image, which then exfiltrate user-provided data, downloads and install next stage code,...

Malicious code in fake-usreagent (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f4baefb66829fd54eeb9a557917c302ba8588059ca8483d1a56b06518d7638d4 Inside the library there is a part running code hidden in the attached image, which then exfiltrate user-provided data, downloads and install next stage code,...

MAL-2024-11599 Malicious code in gen-user-random-agent (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4e261c26a73604aac348f2df96e5b12b0817010a9a1bbc48ddfbe309915c697b Inside the library there is a part running code hidden in the attached image, which then exfiltrate user-provided data, downloads and install next stage code,...

MAL-2024-11564 Malicious code in crypto-format-checking (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a95b535a5d579db23cf10d4a9897278238afb3093600235b1f39ddf2cca74600 Inside the library there is a part running code hidden in the attached image, which then exfiltrate user-provided data, downloads and install next stage code,...

Malicious code in sol-regex-gener (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 863af188c3f151e9ad44d0ed55e0a5faa7120032979ffcdbc822b6dd488dfc12 Inside the library there is a part running code hidden in the attached image, which then exfiltrate user-provided data, downloads and install next stage code,...

Malicious code in crypto-format-checking (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a95b535a5d579db23cf10d4a9897278238afb3093600235b1f39ddf2cca74600 Inside the library there is a part running code hidden in the attached image, which then exfiltrate user-provided data, downloads and install next stage code,...

MAL-2024-11734 Malicious code in ua-agent-generator (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7294a5078d47d2797cf31931252b823374b648a48534bc14b59cd73195cfe2f1 Inside the library there is a part running code hidden in the attached image, which then exfiltrate user-provided data, downloads and install next stage code,...

Malicious code in useregent-generator (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f0c8bbc66c2a8384b2a35340f4e3204351fbeb78d88a11bec270f8e3e52b5636 Inside the library there is a part running code hidden in the attached image, which then exfiltrate user-provided data, downloads and install next stage code,...

MAL-2024-11590 Malicious code in fake-usreagent (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f4baefb66829fd54eeb9a557917c302ba8588059ca8483d1a56b06518d7638d4 Inside the library there is a part running code hidden in the attached image, which then exfiltrate user-provided data, downloads and install next stage code,...

Malicious code in upllib (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6207428c93f872f851e291726fc7a7384f9226b903c01a5a3f1545f82d66bf0b When importing the module and a specific file exists in the current directory, obfuscated code downloads and starts the next stage of obfuscated code cstealer...

Malicious code in dlibex (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 334235bba91ccf5f6b15b680b7e549e46b7de4a3007d30337b3e72a5124048b6 When importing the module and a specific file exists in the current directory, obfuscated code downloads and starts the next stage of obfuscated code cstealer...

MAL-2024-11579 Malicious code in dlibex (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 334235bba91ccf5f6b15b680b7e549e46b7de4a3007d30337b3e72a5124048b6 When importing the module and a specific file exists in the current directory, obfuscated code downloads and starts the next stage of obfuscated code cstealer...

MAL-2024-11745 Malicious code in vizplotlib (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 198e2d1a1b349ccb49cf0b7f0e25594a096a2bead4a732926c5862cf0764b012 Running the module triggers obfuscated code that downloads a DLL containing reverse shell and injects it to a benign process. --- Category: MALICIOUS - The...

Malicious code in vizplotlib (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 198e2d1a1b349ccb49cf0b7f0e25594a096a2bead4a732926c5862cf0764b012 Running the module triggers obfuscated code that downloads a DLL containing reverse shell and injects it to a benign process. --- Category: MALICIOUS - The...

Malicious code in spiderxr-ai (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0c97841e41e7389c0df8b2d96f2a9b1c033f443358bf780c5988bf352f07608f Every time the user sends a message to the AI, the user IP, message as well as the response are exfiltrated to a hardcoded telegram channel. This behaviour is...

MAL-2024-11713 Malicious code in spiderxr-ai (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0c97841e41e7389c0df8b2d96f2a9b1c033f443358bf780c5988bf352f07608f Every time the user sends a message to the AI, the user IP, message as well as the response are exfiltrated to a hardcoded telegram channel. This behaviour is...

PyPI Repository Found Hosting Fake Crypto Wallet Recovery Tools That Steal User Data

A new set of malicious packages has been unearthed in the Python Package Index PyPI repository that masqueraded as cryptocurrency wallet recovery and management services, only to siphon sensitive data and facilitate the theft of valuable digital assets. "The attack targeted users of Atomic, Trust...