Spyware Offered to Cyberattackers via PyPI Python Repository

Researchers have discovered that malware peddlers are publicly selling information-stealing software on the Python Package Index (PyPI) - the official public repository of the Python programming language - for only thinnest shell.

The attackers, which Sonatype researchers have linked to the SylexSquad malware service (MaaS) gang in Spain, have given their program an unflattering name:
"reverse shell." Reverse shells are programs commonly used by hackers to execute commands remotely and receive data from target machines.

"I think the cool thing about it is that it's so serious," said Dan Conn, developer advocate at Sonatype. "Maybe SylexSquad is promoting their own, or they just don't care about getting caught."

Inside the Data-Heisting "reverse-shell" malware

Sonatype researchers were surprised when they discovered a package called "reverse-shell" on a public forum. "Why would anyone name a malicious package in such a blatant way?" the researchers mused in their blog post for Malware Monthly. In fact, the show turned out to be more than just an upside down hull. This was revealed when researchers studied one of its files, "WindowsDefender.py". WindowsDefender.py contains several explicitly named processes, such as get_login_data(), get_web_history(),get_downloads(),get_cookies(),get_credit_cards(),ImageGrab.grab().

By topic, the hacker didn't go too far to hide his intentions:
it's malware designed to steal information.

"Without cloaking, [this] appears to be a Discord bot executing commands and performing actions on the infected machine," according to the scan. "The malware can retrieve cookies, take screenshots, execute shell commands, steal browsing history, and send all that data to the attacker's Discord channel."

You can find more information in another file named "setup.py". There are some instructions in spanish here for "clone the GitHub repository and run the file", "replace with your GitHub repository URL" and "path where you want to clone the repository" - indicates that the reverse shell is a MaaS product. Further investigation revealed several "Generated by SylexSquad" tags scattered throughout the code, some of which were minimally obfuscated. The researchers found that SylexSquad was once a hacking marketplace that ran on the Sellix e-commerce platform in 2022. It was then shut down.

Such public posting in a public repository may be an intentional attempt by the organization to draw attention to its product. “How do we know groups like Anonymous, LulzSec or Killnet? Conn asked rhetorically. "That's because they have a bad reputation."

However, for them, PyPI is worth much more than that.

Why do hackers use public repositories?

According to Sonatype, the SylexSquad attackers aren't the only bad guys using forums like PyPI and GitHub, and there are many reasons for their audacity.

"Storing malicious files on public repositories allows malicious actors to better control them," the researchers explain in their blog post. "This gives them the power to remove, upgrade or even version control the payload."

Among other benefits, "it allows malware to be shared much more widely," explains Conn, "and it can actually enable, in particular, many anti-virus software to use generic signature — like real bytes — to store whether something malicious is present."

In other words, instead of sending malware ahead of time, which an antivirus scanner can quickly detect, hackers could simply provide a link to their malicious code elsewhere:
“By providing a link to GitHub, they can evade this check,” he said. To avoid becoming a hotspot for hackers, public repositories have safeguards in place. Even the best scanners and moderators aren't perfect, and they can't be everywhere at once.

“Hackers take certain measures, such as encrypting or obfuscing the code they store, to make the detection of tools automated,” said Juan Aguirre, security researcher at Sonatype. becomes a little more difficult.” SylexSquad encoded its malware as numbers in this example, using an easily reversible ASCII code for each character.

Sonatype reported this package to the PyPI maintainers and it was removed. But "it's just a cat-and-mouse game," Aguirre said. "Someone grabbed them and they ran to the next place."

Aguirre sees this story as part of a larger problem with open source software:
As long as malware developers find use in public repositories, organizations should be aware of the types of packages they can obtain. "It's important to understand what you're running," he concludes. "It's a great case for that. You need a BOM, you need to know what you're doing and what dependencies you're using. If you just blindly install things and get the code, you're fine. see, things like that can very easily get into your system."​