Phishing attacks have targeted developers who publish Python packages on PyPI. Attackers sent urgent security emails that led to a fake PyPI login page and captured account details. They then used the stolen logins to add malicious code to packages. This matters to anyone who publishes or installs Python packages.
In PyPI, a software repository for the Python programming language, it has been detected that phishing attacks targeting project developers have been carried out by injecting malicious code into Python packages by threat actors. These phishing attacks aim to capture software developers’ identity information.How does the PyPI phishing attack work?
The attack vector begins when threat actors send phishing e-mails to developers expressing security-related urgency. Then, by clicking on the URL link in the e-mail text, the developers are directed to a phishing page created by imitating the user login page of the PyPI platform. With the members’ login by providing their information, this login information is captured by the threat actors. Then, the threat actors log into the PyPI platform with the login information of the developers and inject malicious code into the Python packages included in it.- Urgent e-mailDevelopers receive a message that expresses security-related urgency
- Fake login pageThe link leads to a page imitating the PyPI login
- Credentials capturedDevelopers enter their details and the threat actors take them
- Packages poisonedThe attackers log in and inject malicious code into the developers’ packages
How can developers protect themselves from phishing?
In order not to be the target of similar attacks that may be carried out in this context, it is recommended to implement the security steps given below.- Developers at risk of being hacked should reset their passwords and 2FA recovery codes.
- E-mails, attachments, or links from suspicious and unknown parties should not be opened.
- Beware of unreliable content.
- Comprehensive security solutions should be used.
- Detected IoC findings related to the attack campaign should be blocked by the security solutions.