Malicious code in innostage (PyPI)

The package contains code to download and execute a reverse shell script. --- -= Per source details. Do not edit below this line.=- Source: kam193 ec433c9a241ed7127dc5d6f55b002e94a2407ddd47000e50355f118536e9021e When imported, the package download and runs a remote stage - a reverse shell. To mas...

Malicious code in instaread (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 792748013463fb0303ff6033b47dcb48c23dc944d5075a8859b6997eafd47a56 The file bc2556d1c1ea2a2d00.js contains an AdWare LNKR, this file is included in readarticle.html template and effectively used when the user requests to see t...

Malicious code in pyutiltool (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 33b1b5a9f2482626b8ff1dc21fbf8da61082231e20f1b87060ab133957ce634f When importing the module and a specific file exists in the current directory, obfuscated code downloads and starts the next stage of obfuscated code cstealer...

Malicious code in upllib (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6207428c93f872f851e291726fc7a7384f9226b903c01a5a3f1545f82d66bf0b When importing the module and a specific file exists in the current directory, obfuscated code downloads and starts the next stage of obfuscated code cstealer...

Malicious code in exflibrary (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 95deb938eb8fd38976a38faf2fd2117318966fc829c080f35d6d999ff37d1236 When importing the module and a specific file exists in the current directory, obfuscated code downloads and starts the next stage of obfuscated code cstealer...

MAL-2024-11686 Malicious code in pyutiltool (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 33b1b5a9f2482626b8ff1dc21fbf8da61082231e20f1b87060ab133957ce634f When importing the module and a specific file exists in the current directory, obfuscated code downloads and starts the next stage of obfuscated code cstealer...

Malicious code in dlibex (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 334235bba91ccf5f6b15b680b7e549e46b7de4a3007d30337b3e72a5124048b6 When importing the module and a specific file exists in the current directory, obfuscated code downloads and starts the next stage of obfuscated code cstealer...

MAL-2024-11579 Malicious code in dlibex (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 334235bba91ccf5f6b15b680b7e549e46b7de4a3007d30337b3e72a5124048b6 When importing the module and a specific file exists in the current directory, obfuscated code downloads and starts the next stage of obfuscated code cstealer...

MAL-2024-11745 Malicious code in vizplotlib (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 198e2d1a1b349ccb49cf0b7f0e25594a096a2bead4a732926c5862cf0764b012 Running the module triggers obfuscated code that downloads a DLL containing reverse shell and injects it to a benign process. --- Category: MALICIOUS - The...

Malicious code in alfooou (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5bb42c1e46cc4a000429770c7e316646bab8170a9f1191e3f196a4f05a65605f Running the module triggers obfuscated code that downloads a DLL containing reverse shell and injects it to a benign process. --- Category: MALICIOUS - The...

Malicious code in vizplotlib (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 198e2d1a1b349ccb49cf0b7f0e25594a096a2bead4a732926c5862cf0764b012 Running the module triggers obfuscated code that downloads a DLL containing reverse shell and injects it to a benign process. --- Category: MALICIOUS - The...

Malicious code in viplotlib (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2613f1ba2960b7e0358efd0c3e8cf7977619c4c21f485a57bc5244e063cdf1db Running the module triggers obfuscated code that downloads a DLL containing reverse shell and injects it to a benign process. --- Category: MALICIOUS - The...

Malicious code in spiderxr-ai (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0c97841e41e7389c0df8b2d96f2a9b1c033f443358bf780c5988bf352f07608f Every time the user sends a message to the AI, the user IP, message as well as the response are exfiltrated to a hardcoded telegram channel. This behaviour is...

MAL-2024-11713 Malicious code in spiderxr-ai (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0c97841e41e7389c0df8b2d96f2a9b1c033f443358bf780c5988bf352f07608f Every time the user sends a message to the AI, the user IP, message as well as the response are exfiltrated to a hardcoded telegram channel. This behaviour is...

Malicious code in spider-ai (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 aaeb144e288d0288f6013d64f0e9e57164e5c3eded3924fd2282577b59c28f1a Every time the user sends a message to the AI, the user IP, message as well as the response are exfiltrated to a hardcoded telegram channel. This behaviour is...

Malicious code in discord-token-lib (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 44f591d196b048c4cad8da1cc1399681e22a2d5786fb212fda7c920aed8c2b07 osint packages promise to be OSINT tool, however, when providing the username to search for, the package attempts to exfiltrate Discord tokens from the user. T...

Malicious code in titan-osint (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e8dccaf6be8892f2b8871e634607d1dafc9fbb2b5855156959c454b07ab184aa osint packages promise to be OSINT tool, however, when providing the username to search for, the package attempts to exfiltrate Discord tokens from the user. T...

PyPI Repository Found Hosting Fake Crypto Wallet Recovery Tools That Steal User Data

A new set of malicious packages has been unearthed in the Python Package Index PyPI repository that masqueraded as cryptocurrency wallet recovery and management services, only to siphon sensitive data and facilitate the theft of valuable digital assets. "The attack targeted users of Atomic, Trust...

Malicious code in website-scanner (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 bab4a414e51f614858ff935138ccb2632b0ba1801566c398a699e692715ccaae The obfuscated code in setup.py on installation collects information about the system all possible about hardware, available resources, IP, names, etc. and sen...

MAL-2024-12280 Malicious code in google-play-store (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b0f8bc12f61546bde84dd1d7a64519fcdc55ce875b71f3d8d848d2d5daa2248d This is a copy of https://pypi.org/project/play-scraper/ with added a very questionable "telemetry": in scraper.py, L90 sends the user hostname, IP and the exa...