Multiple 0-Day Attacks in The PyPI Packages Aimed to Steal Developer Credentials

However, what was alarming was the fact that all of these packages contained similar malicious code. This raises the question of the level of sophistication and the intentions behind these attacks.  Technical Analysis of the Packages First of all, cybersecurity analysts have noticed something that looks like a URL for a webhook in its setup[.]py file:- hxxps://discord[.]com/api/webhooks/1069214746395562004/sejnJnNA3lWgkWC4V86RaFzaiUQ3dIAG958qwAUkLCkYjJ7scZhoa-KkRgBOhQw8Ecqd There is a similar code in each package’s setup.py file except for the URL of the webhook that is sent from each package.

Read full article on GBHackers

 


Date:

Categorie(s):