Malicious Python packages form serious security threat, Checkmarx study reveals

New research from Checkmarx reveals a substantial security threat to the Python programming community, as malicious Python packages, disguised as legitimate obfuscation tools, are used by attackers to gain complete control over a victim's computer. This dangerous method, named BlazeStealer, involves a disguised payload that is activated when a victim unsuspectingly installs a deceptive package into their operative system.

Throughout 2023, these bogus tools have been strategically named with prefixes resembling authentic obfuscation tools, often used by developers for Python code obfuscation. Packages like pyobf have been used as vehicles for this malicious payload, sending taunts through messages like "Your computer is going to start burning, good luck :)" and "Your computer is going to die now, good luck getting it back :)" to their victims.

The payload, known as BlazeStealer, retrieves a malicious script from an external source, enabling a Discord bot. The activated bot grants attackers complete control over the infected computer, allowing them to commandeer the victim's computer camera and capture images that are returned to a Discord channel. This forms part of its wide range of capabilities that include stealing sensitive information, taking passwords from the Chrome web browser, inputting keyloggers, and downloading files from the victim's system. The bot can capture screenshots, render the computer non-operational for various reasons, and even deactivate Windows Defender and Task Manager. Shockingly, it can execute any command on the compromised system.

Among these malicious functions, the attackers send grim messages, seemingly intended to emotionally torment the victims. As they annihilate the computer's functionality, they jape, "Your computer is going to start burning, good luck :)" not only revealing malicious intent but also the audacity and casual inhumanity of the perpetrators.

The targets of these attacks are likely developers engaged in code obfuscation and dealing with valuable and sensitive information, which makes them valuable targets for hackers. Frequently they become the victims caught in this ruthless act of cyber aggression. This alarming trend highlights the ever-present dangers lurking within open-source domain, and the importance of vigilance while using open-source tools.

Checkmarx's research team, as part of their Supply Chain Security solution, continuously monitors for any suspicious activities within the open-source software ecosystem, tracking signals for foul play and alerting their customers for their prevention. However, no matter the protection developers may have in place, they must always remain vigilant and thoroughly vet any packages prior to consumption to safeguard against such elaborate and harmful attacks.