This sophisticated attack targets developers who have published packages on the official repository, leveraging their trust in the PyPI ecosystem to harvest login credentials through a carefully crafted fake website that mimics the legitimate platform. The malicious emails carry the subject line “[PyPI] Email verification” and from noreply@pypj[.]org specifically target users who have published projects on PyPI with their email addresses included in package metadata. The organization has implemented immediate countermeasures, including displaying a prominent warning banner on the PyPI homepage to alert users about the ongoing attack. The Python Package Index (PyPI) has issued an urgent warning to developers about an ongoing phishing campaign that exploits domain spoofing techniques to steal user credentials. The attack demonstrates advanced social engineering principles by exploiting the established trust relationship between developers and the PyPI ecosystem. This technique creates the illusion that users have successfully logged into the real PyPI platform while attackers are harvesting their credentials. Fake emails from pypj.org redirect to a counterfeit PyPI site, stealing credentials. When recipients click the verification link, they are redirected to a sophisticated phishing site that closely replicates the official PyPI interface. Official PyPI uncompromised, but developers with public emails are being targeted.
This Cyber News was published on cybersecuritynews.com. Publication date: Tue, 29 Jul 2025 12:55:17 +0000