We analyze Python packages that steal Telegram Desktop client files and set up Remote Desktop access accounts after infecting Windows systems.
Read More...
This Week in Malware — Python cryptominers, 345 dependency confusion packages
16 minute read time
This week's highlights include a PyPI typosquat that drops a cryptominer and AWS credential stealer, along with an influx of 345 dependency confusion packages.
Read More...
python-dateutils — A cryptominer in disguise targeting Windows, Linux, macOS
5 minute read time
We analyze a suspicious 'python-dateutils' PyPI package targeting Python developers to mine cryptocurrency after infecting their Windows, macOS or Linux.
Read More...
This Week in Malware — Show me your secrets!
2 minute read time
These Python packages not only exfiltrate your secrets—AWS credentials and environment variables but rather upload these to a publicly exposed endpoint.
Read More...
Python packages upload your AWS keys, env vars, secrets to the web
5 minute read time
Multiple Python packages caught by Sonatype were seen uploading secrets such as AWS keys and environment variables to a web endpoint.
Read More...
This Week in Malware — Killing Windows Defender with an npm package
3 minute read time
This Week in Malware we discuss a malicious npm package that disables Windows Defender before dropping a trojan, and ongoing dependency confusion findings.
Read More...
npm package disables Windows Defender before dropping Trojan
3 minute read time
npm package 'flame-vali' makes multiple attempts to disable Windows Defender on the infected system before downloading a cryptominer.
Read More...
This Week in Malware — npm malware exfiltrates Windows SAM, Amazon EC2 credentials
4 minute read time
Malicious packages caught this week exfiltrate Amazon EC2, Windows SAM credentials, and launch malicious executables.
Read More...
PyPI package 'ctx' and PHP library 'phpass' compromised to steal environment variables
5 minute read time
Popular Python package 'ctx' that is downloaded over 22,000 times weekly on PyPI registry has been compromised and now steals environment variables.
Read More...