- Security researchers received three malicious PyPI packages
- There were about 7,000 downloads in packages
- They were designed to check active email accounts
Security researchers have found that some equipment is the use of cyber criminal to steal people’s Instagram and Ticketkok accounts – on PyPI.
The Python Package Index (PyPI) is one of the world’s largest repository of the Python Code, often abused Holstis malicious codes, or trick software developers to download and run tainted codes in their projects.
In this case, the security researchers of the socket found three packages, named “Checker-Sagaf”, “Stepinus” and “Cynecore”. Cumming, these three had around 7,000 downloads before being pulled from the platform.
Credential stuffing and password spraying
The first two served as verifications of email addresses, cross-referenceing supplied email address with Tikokkok and Instagram API, to see if they are associated with accounts on stage. Researchers explained that if an email address is valid, it does not seem particularly harmful, it is an important step in cyber criminal activity.
Olivia Brown of the socket said, “Once the danger actors have this information, only one email address, they can threaten dox or spam, can conduct fake report attacks to suspend the accounts, or only a credential stuffing or password spray before spraying the target accounts,” said the Olivia Brown of the socket.
“Calcular user lists are also sold on the dark web for benefits. It may seem harmless to build active email dictionaries, but this information enables and accelerates the whole attack chains and reduces detection by targeting only known-walid accounts.”
The third package, “sinnercore”, triggers the flow “forgotten” flow for the user name given on Instagram.
This news comes about a month later when researchers found two malicious packages on PyPI, a popular, presented as a reform for a valid package. Malware was designed to steal people’s cryptocurrency, which is a popular attack vector on PyPI. In this case, the valid package is used in the manufacture of “hot wallets” – software wallet for cryptocurrency. Despite having clear malware, both packages still managed to rake in over 37,000 downloads before being pulled.
Through Hacker news
