Experts warn of the first known phishing attack against PyPI

The Python Package Index (PyPI) warns of an ongoing phishing campaign to steal developer credentials and distribute malicious updates.

The Python Package Index, PyPI, this week warned of an ongoing phishing campaign that aims to steal developer credentials and inject malicious updates to the packages in the repository.

“Today we received reports of a phishing campaign targeting PyPI users. This is the first known phishing attack against PyPI.” states the warning.

The phishing messages are designed to trick recipients into clicking on a link to be compliant with a new Google mandatory validation process on all packages. Recipients are urged to complete the validation procedure by September, to avoid the removal of their packages from PyPI.

Upon clicking on the link, users are directed to a landing page that mimics PyPI’s login page and is hosted on Google Sites.

Once the attackers obtained the user account credentials, they were able to push malicious updates to legitimate packages.

According to Checkmarx researcher Aviad Gershon first known phishing campaign targeting PyPI Users, the researchers are aware of hundreds of malicious packages that were part of this attack.

“The phishing attempt and the malicious packages are linked by the domain linkedopports[.]com, which appears in the malicious package code and also functions as the location to which the phishing site tries to send the stolen credentials.” reads the analysis published by Checkmarx.

The malicious packages employed in this campaign are trying to download and execute a file from the URL hxxps://python-release[.]com/python-install.scr.

At the time of the discovery, the packages had a low detection, the malicious code is digitally signed and is untypically large (~63MB) in an attempt to evade AV detection).

The researchers also found another domain related to this attacker’s infrastructure, “ledgdown[.]com”, registered under the same IP. This domain poses as a legitimate website of the crypto assets app “ledger live.”

“This is another step in the attacks against open source packages and open source contributors.” concludes the post. “We recommend checking your network traffic against the IOCs listed below and as always, encouraging contributors to use 2FA.”

Update: Following the phishing attack, PyPI said it’s revising its eligibility requirements for the hardware security key program. “Any maintainer of a critical project, regardless of whether they already have TOTP-based 2FA enabled, is now eligible,” it noted.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, PyPI)