Cybersecurity researchers reported that malware packages were detected in the Python Package Index (PyPI) called WhiteSnake Stealer.
These packages contain malware for Windows. The linked packages, named nigpal, figflix, telerer, seGMM, fbdebug, sGMM, myGens, NewGends, and TestLibs111, were uploaded by user “WS”. These packages contain the Base64 encoded source code in the setup.py files.
Read more: LODEINFO backdoor malware gains new capabilities
The operation of WhiteSnake Stealer is operating system dependent, with the malware executing after Python packages are installed. The attack is primarily targeted at Windows systems, but there is also a version for Linux hosts.
The WhiteSnake malware has a virtual machine detection mechanism, uses the Tor protocol to communicate with a central server, and steals personal data from victims. It is also designed to exfiltrate data from browsers, cryptocurrency wallets, and applications such as WinSCP, CoreFTP, Filezilla, Steam, Discord, Signal , and Telegram. This activity coincides with a previous report last year by JFrog and Checkmarx.
Checkmarx is tracking the PYTA31 threat campaign, which targets wallets with sensitive and encrypted data. Clipper packages are reported that replace content with hacker addresses for fraudulent transactions. Some packages also steal data from browsers and encryption services . Fortinet points out the malware's ability to spread multiple packages of varying complexity.
See more: Malicious npm and PyPi packages discovered stealing sensitive data from devs
ReversingLabs discovered packages on npm that exploit GitHub to store SSH keys stolen from developers' systems.
Source: thehackernews.com
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
