A few hours ago, The Python Package Index (PyPi) suspended new project creation and new user registration to mitigate an ongoing malware upload campaign.

The research team of Checkmarx simultaneously investigated a campaign of multiple malicious packages appear to be related to the same threat actors.

The threat actors target victims with Typosquatting attack technique using their CLI to install Python packages. 

This is a multi-stage attack and the malicious payload aimed to steal crypto wallets, sensitive data from browsers (cookies, extensions data, etc..) and various credentials.

In addition, the malicious payload employed a persistence mechanism to survive reboots.

PyPi Suspended User and Project Creation

A few hours ago, on Mar 28, 2024 – 02:16 UTC, The Python Package Index (PyPi) added a new website banner and released an official update: “We have temporarily suspended new project creation and new user registration to mitigate an ongoing malware upload campaign”

Evidence of Multiple Malicious Typosquatting Packages

Between March 27 and March 28, 2024, multiple malicious Python packages were uploaded on the Python Package Index (PyPI). These packages most likely created using automation 

The Malicious Payload

The malicious code is located within each package’s setup.py file, enabling automatic execution upon installation.

employed a technique where the setup.py file contained obfuscated code that was encrypted using the Fernet encryption module. When the package was installed, the obfuscated code was automatically executed, triggering the malicious payload.

Upon execution, the malicious code within the setup.py file attempted to retrieve an additional payload from a remote server. The URL for the payload was dynamically constructed by appending the package name as a query parameter. 

The retrieved payload was also encrypted using the Fernet module, Once decrypted, the payload revealed an extensive info-stealer designed to harvest sensitive information from the victim’s machine.

The malicious payload also employed a persistence mechanism to ensure it remained active on the compromised system even after the initial execution.

A small piece of the larger script

Summary

The discovery of these malicious Python packages on PyPI highlights the ongoing nature of cybersecurity threats within the software development ecosystem.

This incident is not an isolated case, and similar attacks targeting package repositories and software supply chains are likely to continue.

As this situation unfolds, we will provide updates on any new developments.

Working together to keep the open source ecosystem safe.

Package List

package_name date event
requiremetstx 28/03/2024 remove project
requiremntstx 28/03/2024 remove project
requirementstxxt 28/03/2024 remove project
requiremetnstxt 28/03/2024 remove project
requiirementstx 28/03/2024 remove project
requirrementstxt 28/03/2024 remove project
requirmentstx 28/03/2024 remove project
requiremnetxtxt 28/03/2024 remove project
requiremmentxt 28/03/2024 remove project
requirment 28/03/2024 remove project
requirementstx 28/03/2024 remove project
requiremetstxt 28/03/2024 remove project
requiirementstxt 28/03/2024 remove project
requiremnets 28/03/2024 remove project
requirments 28/03/2024 remove project
requiements 28/03/2024 remove project
requriments 28/03/2024 remove project
requiurement 28/03/2024 remove project
reuirements 28/03/2024 remove project
requiiremnts 28/03/2024 remove project
requiremeents 28/03/2024 remove project
cstmotkinter 28/03/2024 remove project
customtkintre 28/03/2024 remove project
customtkinetr 28/03/2024 remove project
custmtokinter 28/03/2024 remove project
customekinter 28/03/2024 remove project
customtkibter 28/03/2024 remove project
custontkinter 28/03/2024 remove project
custojtkinter 28/03/2024 remove project
custojmtkinter 28/03/2024 remove project
custumtkinter 28/03/2024 remove project
customtkinted 28/03/2024 remove project
customtkjnter 28/03/2024 remove project
trnsorflow 28/03/2024 remove project
tensxoflow 28/03/2024 remove project
tensourflow 28/03/2024 remove project
tensogflow 28/03/2024 remove project
tensofpow 28/03/2024 remove project
tensoflxow 28/03/2024 remove project
tensoflw 28/03/2024 remove project
tensoflsw 28/03/2024 remove project
tensoflqw 28/03/2024 remove project
tensoflpw 28/03/2024 remove project
tensoflouw 28/03/2024 remove project
tensoflor 28/03/2024 remove project
tensoflonw 28/03/2024 remove project
tensoflomw 28/03/2024 remove project
tensoflom 28/03/2024 remove project
tensoflolw 28/03/2024 remove project
tensoflod 28/03/2024 remove project
tensofloaw 28/03/2024 remove project
tensofllow 28/03/2024 remove project
tensofliw 28/03/2024 remove project
tensofleow 28/03/2024 remove project
tensoflaow 28/03/2024 remove project
tensofla 28/03/2024 remove project
tensofl9w 28/03/2024 remove project
tensofklow 28/03/2024 remove project
tensobflow 28/03/2024 remove project
tensnflow 28/03/2024 remove project
temsorflow 28/03/2024 remove project
Sjmplejson 28/03/2024 remove project
Sjimplejson 28/03/2024 remove project
Siplejason 28/03/2024 remove project
Simpoejson 28/03/2024 remove project
Simplejsoj 28/03/2024 remove project
Simplejsoh 28/03/2024 remove project
Simplejdon 28/03/2024 remove project
Simplejason 28/03/2024 remove project
Simpkejson 28/03/2024 remove project
Simpjson 28/03/2024 remove project
Simpejso 28/03/2024 remove project
Simolejson 28/03/2024 remove project
Simepljson 28/03/2024 remove project
Sijplejson 28/03/2024 remove project
Sijplejso 28/03/2024 remove project
selunium 28/03/2024 remove project
sellinium 28/03/2024 remove project
selleniumm 28/03/2024 remove project
sellenim 28/03/2024 remove project
selleniium 28/03/2024 remove project
selleium 28/03/2024 remove project
selinum 28/03/2024 remove project
seliniumn 28/03/2024 remove project
seliniumm 28/03/2024 remove project
seleunium 28/03/2024 remove project
selenyum 28/03/2024 remove project
selenuimm 28/03/2024 remove project
selennuim 28/03/2024 remove project
selenniumm 28/03/2024 remove project
selennim 28/03/2024 remove project
selenimn 28/03/2024 remove project
selemniumm 28/03/2024 remove project
selemnium 28/03/2024 remove project
selemnim 28/03/2024 remove project
selemni 28/03/2024 remove project
selemiumm 28/03/2024 remove project
seleiumm 28/03/2024 remove project
seleinuim 28/03/2024 remove project
seleiniumm 28/03/2024 remove project
seleinium 28/03/2024 remove project
seleeniumm 28/03/2024 remove project
seleenimu 28/03/2024 remove project
seleenim 28/03/2024 remove project
requriements 28/03/2024 remove project
requrementstxt 28/03/2024 remove project
requiurementstxt 28/03/2024 remove project
requirtements 28/03/2024 remove project
requirmentstxtt 28/03/2024 remove project
requirmentstxt 28/03/2024 remove project
requirmentss 28/03/2024 remove project
requirmeents 28/03/2024 remove project
requiremtns 28/03/2024 remove project
requiremntxtxt 28/03/2024 remove project
requiremntstxt 28/03/2024 remove project
requiremnts 28/03/2024 remove project
requiremnetstxt 28/03/2024 remove project
requiremmentxtxt 28/03/2024 remove project
requiremmentstxt 28/03/2024 remove project
requiremments 28/03/2024 remove project
requiremetns 28/03/2024 remove project
requirementxxt 28/03/2024 remove project
requirementxtt 28/03/2024 remove project
requirementxt 28/03/2024 remove project
requirementxstxt 28/03/2024 remove project
requirementtsxt 28/03/2024 remove project
requirementt 28/03/2024 remove project
requirementstxx 28/03/2024 remove project
requirementstxtxt 28/03/2024 remove project
requirementstxtx 28/03/2024 remove project
requirementstxtt 28/03/2024 remove project
requirementsttx 28/03/2024 remove project
requirementstt 28/03/2024 remove project
requirementst 28/03/2024 remove project
requirementss 28/03/2024 remove project
requiremenstxt 28/03/2024 remove project
requiremenstx 28/03/2024 remove project
requiremants 28/03/2024 remove project
requiirments 28/03/2024 remove project
requiiremments 28/03/2024 remove project
requiirementsxt 28/03/2024 remove project
requiirements 28/03/2024 remove project
requierments 28/03/2024 remove project
requierement 28/03/2024 remove project
reqiuremnets 28/03/2024 remove project
reqiurementstxt 28/03/2024 remove project
reqiurements 28/03/2024 remove project
reqiremnts 28/03/2024 remove project
reqiremnets 28/03/2024 remove project
reqirements 28/03/2024 remove project
PzTorch 28/03/2024 remove project
PzGame 28/03/2024 remove project
PyTrosh 28/03/2024 remove project
PyTroce 28/03/2024 remove project
PyTprch 28/03/2024 remove project
PyTorqh 28/03/2024 remove project
PyTordh 28/03/2024 remove project
PyTorcu 28/03/2024 remove project
PyTorcm 28/03/2024 remove project
PyTorchy 28/03/2024 remove project
PyTorchv 28/03/2024 remove project
PyTorchj 28/03/2024 remove project
PyTorchg 28/03/2024 remove project
PyTorchc 28/03/2024 remove project
PyTorchb 28/03/2024 remove project
PyTorcdh 28/03/2024 remove project
PyTorcb 28/03/2024 remove project
PyTorbch 28/03/2024 remove project
PyToich 28/03/2024 remove project
PyTlrc 28/03/2024 remove project
PyTirch 28/03/2024 remove project
PyThrch 28/03/2024 remove project
PyTcrch 28/03/2024 remove project
PyTbrch 28/03/2024 remove project
PyTarch 28/03/2024 remove project
PyGzme 28/03/2024 remove project
PyGxme 28/03/2024 remove project
PyGvame 28/03/2024 remove project
PyGume 28/03/2024 remove project
PyGqme 28/03/2024 remove project
PyGqame 28/03/2024 remove project
PyGmme 28/03/2024 remove project
PyGhame 28/03/2024 remove project
PyGfme 28/03/2024 remove project
PyGfame 28/03/2024 remove project
PyGazme 28/03/2024 remove project
PyGawme 28/03/2024 remove project
PyGarme 28/03/2024 remove project
PyGaqme 28/03/2024 remove project
PyGaome 28/03/2024 remove project
PyGane 28/03/2024 remove project
PyGamw 28/03/2024 remove project
PyGamse 28/03/2024 remove project
PyGamr 28/03/2024 remove project
PyGamne 28/03/2024 remove project
Pygamm 28/03/2024 remove project
PyGamke 28/03/2024 remove project
PyGaime 28/03/2024 remove project
PyGaeme 28/03/2024 remove project
PyGacme 28/03/2024 remove project
PtTorch 28/03/2024 remove project
PqTorch 28/03/2024 remove project
plywright 28/03/2024 remove project
plyawright 28/03/2024 remove project
playwritgh 28/03/2024 remove project
playwrihgt 28/03/2024 remove project
playwrigth 28/03/2024 remove project
playwrightt 28/03/2024 remove project
playwrigh 28/03/2024 remove project
playwrigght 28/03/2024 remove project
playwrgith 28/03/2024 remove project
playwrgiht 28/03/2024 remove project
playwrght 28/03/2024 remove project
playwirght 28/03/2024 remove project
playrwight 28/03/2024 remove project
plawyright 28/03/2024 remove project
plawwright 28/03/2024 remove project
plauwright 28/03/2024 remove project
plaawright 28/03/2024 remove project
Matplutlib 28/03/2024 remove project
Matplttlib 28/03/2024 remove project
Matpltotlib 28/03/2024 remove project
Matplrtlib 28/03/2024 remove project
Matplrtib 28/03/2024 remove project
Matplptlib 28/03/2024 remove project
Matplotvlib 28/03/2024 remove project
Matplotvib 28/03/2024 remove project
Matplottlab 28/03/2024 remove project
Matplottib 28/03/2024 remove project
Matplottbib 28/03/2024 remove project
Matplotpib 28/03/2024 remove project
Matplotoib 28/03/2024 remove project
Matplotlyib 28/03/2024 remove project
Matplotlub 28/03/2024 remove project
Matplotltib 28/03/2024 remove project
Matplotlr 28/03/2024 remove project
Matplotlpib 28/03/2024 remove project
Matplotlob 28/03/2024 remove project
Matplotllib 28/03/2024 remove project
Matplotlig 28/03/2024 remove project
Matplotlbib 28/03/2024 remove project
Matplotklib 28/03/2024 remove project
Matplotkib 28/03/2024 remove project
Matplotib 28/03/2024 remove project
Matplotblib 28/03/2024 remove project
Matplorlib 28/03/2024 remove project
Matploptlib 28/03/2024 remove project
Matplootib 28/03/2024 remove project
Matploltlib 28/03/2024 remove project
Matploltlab 28/03/2024 remove project
Matplolplib 28/03/2024 remove project
Matpllotib 28/03/2024 remove project
Matpllotb 28/03/2024 remove project
Matplkotlib 28/03/2024 remove project
Matpliotlib 28/03/2024 remove project
Matplftlib 28/03/2024 remove project
Maptplotlib 28/03/2024 remove project
cuxtomtkinter 28/03/2024 remove project
cuwtomtkinter 28/03/2024 remove project
cutomtkinter 28/03/2024 remove project
custvomtkinter 28/03/2024 remove project
custrmtkinter 28/03/2024 remove project
custpmtkinter 28/03/2024 remove project
custoumtkinter 28/03/2024 remove project
custotminter 28/03/2024 remove project
custotkminter 28/03/2024 remove project
custotkinter 28/03/2024 remove project
custotinter 28/03/2024 remove project
custoqtkinter 28/03/2024 remove project
customtkznter 28/03/2024 remove project
customtkwnter 28/03/2024 remove project
customtknter 28/03/2024 remove project
customtknster 28/03/2024 remove project
customtkniterr 28/03/2024 remove project
customtkniter 28/03/2024 remove project
customtkknter 28/03/2024 remove project
customtkiyter 28/03/2024 remove project
customtkitnre 28/03/2024 remove project
customtkitnerr 28/03/2024 remove project
customtkitner 28/03/2024 remove project
customtkiter 28/03/2024 remove project
customtkitenr 28/03/2024 remove project
customtkinyer 28/03/2024 remove project
customtkintwr 28/03/2024 remove project
customtkintrr 28/03/2024 remove project
customtkintrer 28/03/2024 remove project
customtkintet 28/03/2024 remove project
customtkintert 28/03/2024 remove project
customtkinteer 28/03/2024 remove project
customtkinte 28/03/2024 remove project
customtkintar 28/03/2024 remove project
customtkinrer 28/03/2024 remove project
customtkingter 28/03/2024 remove project
customtkinger 28/03/2024 remove project
customtkinet 28/03/2024 remove project
customtkinber 28/03/2024 remove project
customtkimter 28/03/2024 remove project
customtkihter 28/03/2024 remove project
customtkfnter 28/03/2024 remove project
customtjinter 28/03/2024 remove project
customtinter 28/03/2024 remove project
customtiknter 28/03/2024 remove project
customtikinter 28/03/2024 remove project
customkinter 28/03/2024 remove project
custoktkinter 28/03/2024 remove project
custohtkinter 28/03/2024 remove project
custogtkinter 28/03/2024 remove project
custmtkinter 28/03/2024 remove project
BeutifulSoop 28/03/2024 remove project
BeutifullSoup 28/03/2024 remove project
BeuatiflSoup 28/03/2024 remove project
BeautySoup 28/03/2024 remove project
BeautyfulSoup 28/03/2024 remove project
BeautilfulSoup 28/03/2024 remove project
BeautifuoSoup 28/03/2024 remove project
BeautifulSoupo 28/03/2024 remove project
BeautifulSoupe 28/03/2024 remove project
BeautifulSoul 28/03/2024 remove project
BeautifulSoop 28/03/2024 remove project
BeautifullSooup 28/03/2024 remove project
BeautifullSoop 28/03/2024 remove project
BeautifukSoup 28/03/2024 remove project
BeautifuklSoup 28/03/2024 remove project
BeautifoulSoup 28/03/2024 remove project
BeautifolSoup 28/03/2024 remove project
BeautiflulSoup 28/03/2024 remove project
BeautiflulSoop 28/03/2024 remove project
BeautifilSoup 28/03/2024 remove project
BeautifilSoop 28/03/2024 remove project
BeaurifulSoup 28/03/2024 remove project
BeaufifulSoup 28/03/2024 remove project
BeaotifulSoup 28/03/2024 remove project
BeaitifulSoup 28/03/2024 remove project
BeaitifulSoop 28/03/2024 remove project
aysncio 28/03/2024 remove project
asyyncio 28/03/2024 remove project
asynncio 28/03/2024 remove project
asynio 28/03/2024 remove project
asyncioo 28/03/2024 remove project
asyncioi 28/03/2024 remove project
asynciio 28/03/2024 remove project
asyncii 28/03/2024 remove project
asynci 28/03/2024 remove project
asynccio 28/03/2024 remove project
asyncci 28/03/2024 remove project
asyincio 28/03/2024 remove project
assyncio 28/03/2024 remove project
aasyncio 28/03/2024 remove project
reqzests 27/03/2024 remove project
requzsts 27/03/2024 remove project
requyests 27/03/2024 remove project
requxsts 27/03/2024 remove project
requstss 27/03/2024 remove project
requssts 27/03/2024 remove project
requnests 27/03/2024 remove project
requksts 27/03/2024 remove project
requewsts 27/03/2024 remove project
requetsts 27/03/2024 remove project
requetsq 27/03/2024 remove project
requetsa 27/03/2024 remove project
requesxts 27/03/2024 remove project
requesxt 27/03/2024 remove project
requesxs 27/03/2024 remove project
requesuts 27/03/2024 remove project
requestr 27/03/2024 remove project
requesrts 27/03/2024 remove project
requesqs 27/03/2024 remove project
requesks 27/03/2024 remove project
requesgt 27/03/2024 remove project
requeqsts 27/03/2024 remove project
requekts 27/03/2024 remove project
requeksts 27/03/2024 remove project
requeits 27/03/2024 remove project
requas 27/03/2024 remove project
reqsests 27/03/2024 remove project
reqquest 27/03/2024 remove project
reqoests 27/03/2024 remove project
reqjuests 27/03/2024 remove project
reqeyst 27/03/2024 remove project
reqeustz 27/03/2024 remove project
reqeustx 27/03/2024 remove project
reqeuste 27/03/2024 remove project
reqeosts 27/03/2024 remove project
reqeist 27/03/2024 remove project
pycordwd 27/03/2024 remove project
pycordde 27/03/2024 remove project
pycjrd 27/03/2024 remove project
py-xord 27/03/2024 remove project
py-vord 27/03/2024 remove project
py-czrd 27/03/2024 remove project
py-cyrd 27/03/2024 remove project
py-cxrd 27/03/2024 remove project
py-cwrd 27/03/2024 remove project
py-crodd 27/03/2024 remove project
py-crd 27/03/2024 remove project
py-cprd 27/03/2024 remove project
py-cpord 27/03/2024 remove project
py-cozd 27/03/2024 remove project
py-cowrd 27/03/2024 remove project
py-cotrd 27/03/2024 remove project
py-cotd 27/03/2024 remove project
py-corxd 27/03/2024 remove project
py-corx 27/03/2024 remove project
py-corwd 27/03/2024 remove project
py-cortd 27/03/2024 remove project
py-corrd 27/03/2024 remove project
py-corid 27/03/2024 remove project
py-corg 27/03/2024 remove project
py-corfd 27/03/2024 remove project
py-corf 27/03/2024 remove project
py-cordx 27/03/2024 remove project
py-cordw 27/03/2024 remove project
py-cordv 27/03/2024 remove project
py-cordr 27/03/2024 remove project
py-cordq 27/03/2024 remove project
py-cordf 27/03/2024 remove project
py-corde 27/03/2024 remove project
py-corddd 27/03/2024 remove project
py-cordd 27/03/2024 remove project
py-corad 27/03/2024 remove project
py-coqrd 27/03/2024 remove project
py-coordd 27/03/2024 remove project
py-cojrd 27/03/2024 remove project
py-coird 27/03/2024 remove project
py-cofrd 27/03/2024 remove project
py-cofd 27/03/2024 remove project
py-coerd 27/03/2024 remove project
py-coed 27/03/2024 remove project
py-codrd 27/03/2024 remove project
py-cod 27/03/2024 remove project
py-cocd 27/03/2024 remove project
py-cobrd 27/03/2024 remove project
py-coad 27/03/2024 remove project
py-co4d 27/03/2024 remove project
py-ckrd 27/03/2024 remove project
py-ckord 27/03/2024 remove project
py-cird 27/03/2024 remove project
py-cdord 27/03/2024 remove project
py-c9rd 27/03/2024 remove project
py-c0red 27/03/2024 remove project
py-c0dd 27/03/2024 remove project
py-c0crd 27/03/2024 remove project
py-c0ard 27/03/2024 remove project
pullow 27/03/2024 remove project
pollow 27/03/2024 remove project
pjllow 27/03/2024 remove project
pirlow 27/03/2024 remove project
piplow 27/03/2024 remove project
piolow 27/03/2024 remove project
pilpow 27/03/2024 remove project
pillox 27/03/2024 remove project
pilloq 27/03/2024 remove project
pilloo 27/03/2024 remove project
pilloa 27/03/2024 remove project
pillo2 27/03/2024 remove project
pillkw 27/03/2024 remove project
pilliw 27/03/2024 remove project
pilliow 27/03/2024 remove project
pill9w 27/03/2024 remove project
pilkow 27/03/2024 remove project
corlorama 27/03/2024 remove project
colprama 27/03/2024 remove project
colouorama 27/03/2024 remove project
colorramma 27/03/2024 remove project
colorram 27/03/2024 remove project
coloroama 27/03/2024 remove project
colormma 27/03/2024 remove project
colorm 27/03/2024 remove project
colorhrama 27/03/2024 remove project
colorayma 27/03/2024 remove project
coloramzs 27/03/2024 remove project
coloramza 27/03/2024 remove project
coloramxs 27/03/2024 remove project
coloramxa 27/03/2024 remove project
coloramws 27/03/2024 remove project
coloramwa 27/03/2024 remove project
coloramu 27/03/2024 remove project
coloramqs 27/03/2024 remove project
coloramqa 27/03/2024 remove project
coloramoo 27/03/2024 remove project
coloramo 27/03/2024 remove project
coloramna 27/03/2024 remove project
coloramka 27/03/2024 remove project
coloramia 27/03/2024 remove project
colorame 27/03/2024 remove project
coloramaz 27/03/2024 remove project
coloramal 27/03/2024 remove project
coloramah 27/03/2024 remove project
coloramae 27/03/2024 remove project
colorahma 27/03/2024 remove project
colomara 27/03/2024 remove project
colaroma 27/03/2024 remove project
cloroma 27/03/2024 remove project
clolorama 27/03/2024 remove project
cilorama 27/03/2024 remove project
capmostercloudclinet 27/03/2024 remove project
capmostercloudclient 27/03/2024 remove project
capmostercloudclienet 27/03/2024 remove project
capmostercloudclieent 27/03/2024 remove project
capmosterclouclient 27/03/2024 remove project
capmonsterrcloudclient 27/03/2024 remove project
capmonstercouldclient 27/03/2024 remove project
capmonstercoudclient 27/03/2024 remove project
capmonstercludclient 27/03/2024 remove project
capmonsterclouudclient 27/03/2024 remove project
capmonsterclouidclient 27/03/2024 remove project
capmonsterclouddlient 27/03/2024 remove project
capmonsterclouddclient 27/03/2024 remove project
capmonstercloudcluodclient 27/03/2024 remove project
capmonstercloudclouidclient 27/03/2024 remove project
capmonstercloudclinet 27/03/2024 remove project
capmonstercloudclinent 27/03/2024 remove project
capmonstercloudcliient 27/03/2024 remove project
capmonstercloudcliet 27/03/2024 remove project
capmonstercloudclientt 27/03/2024 remove project
capmonstercloudcliennt 27/03/2024 remove project
capmonstercloudclienet 27/03/2024 remove project
capmonstercloudcliendt 27/03/2024 remove project
capmonstercloudcliend 27/03/2024 remove project
capmonstercloudclien 27/03/2024 remove project
capmonstercloudclieet 27/03/2024 remove project
capmonstercloudclieent 27/03/2024 remove project
capmonstercloudcliant 27/03/2024 remove project
capmonstercloudclent 27/03/2024 remove project
capmonstercloudclenit 27/03/2024 remove project
capmonstercloudclenet 27/03/2024 remove project
capmonsterclouclient 27/03/2024 remove project
capmonsterccloudclient 27/03/2024 remove project
capmonsstercloudclient 27/03/2024 remove project
capmonsstercloudcliennt 27/03/2024 remove project
capmoneercloudclient 27/03/2024 remove project
bupi-utils 27/03/2024 remove project
bup-utils 27/03/2024 remove project
bpi-utils 27/03/2024 remove project
bop-utils 27/03/2024 remove project
biup-utils 27/03/2024 remove project
bips-utils 27/03/2024 remove project
bipp-utils 27/03/2024 remove project
bip-uutils 27/03/2024 remove project
bip-uttils 27/03/2024 remove project
bip-utlils 27/03/2024 remove project
bip-utjls 27/03/2024 remove project
bip-utisl 27/03/2024 remove project
bip-utilz 27/03/2024 remove project
bip-utilss 27/03/2024 remove project
bip-utilos 27/03/2024 remove project
bip-utiles 27/03/2024 remove project
bip-utile 27/03/2024 remove project
bip-utilds 27/03/2024 remove project
bip-util 27/03/2024 remove project
bip-uitls 27/03/2024 remove project
bip-uils 27/03/2024 remove project
bip-u8ls 27/03/2024 remove project
biip-utils 27/03/2024 remove project
bibp-utils 27/03/2024 remove project

IOCs

  • hxxps://funcaptcha[.]ru/paste2
  • hxxps://funcaptcha].[ru/delivery
  • hxxps://funcaptcha.ru/atomic/app.asar
  • ABE19B0964DAF24CD82C6DB59212FD7A61C4C8335DD4A32B8E55C7C05C17220D      

0C1DDD33E630F4AC684880F0E673DFA84919272494C11DA0F1EC05FB4F919CE8

Source: Original Post