Using a 'Client' class, the malware forwards traffic from the remote host to the local system through the tunnel, allowing internal admin panel and API access, file transfer, email exfiltration, shell command execution, credentials harvesting, and lateral movement. Seven malicious PyPi packages were found using Gmail's SMTP servers and WebSockets for data exfiltration and remote command execution. The packages used hardcoded Gmail credentials to log into the service's SMTP server (smpt.gmail.com), sending reconnaissance information to allow the attacker to remotely access the compromised system. Socket highlights strong indicators of potential cryptocurrency theft intent for these packages, seen in the email addresses used (e.g., blockchain.bitcoins2020@gmail.com) and similar tactics having been used in the past to steal Solana private keys. The malicious functionality Socket discovered in these packages centers on covert remote access and data exfiltration through Gmail. After the email signaling stage, the implant connects to a remote server using WebSocket over SSL, receiving tunnel configuration instructions to establish a persistent, encrypted, bidirectional tunnel from the host to the attacker. The 'Coffin' packages appear to be impersonating the legitimate Coffin package that serves as a lightweight adapter for integrating Jinja2 templates into Django projects. Bill Toulas Bill Toulas is a tech writer and infosec news reporter with over a decade of experience working on various online publications, covering open-source, Linux, malware, data breach incidents, and hacks. The packages were discovered by Socket's threat research team, who reported their findings to the PyPI, resulting in the removal of the packages. The malicious package, which persists on infected systems via cron jobs, only targets wallets with balances that surpass 1,000 units, attempting to snatch their private keys. The package masquerades as a TypeScript version of the popular but now unmaintained 'CryptoJS' library while exfiltrating cryptocurrency wallet secrets and environment variables to a threat actor-controlled Better Stack endpoint.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Thu, 01 May 2025 16:30:09 +0000