www.bleepingcomputer.com
Open in
urlscan Pro
104.20.60.209
Public Scan
URL:
https://www.bleepingcomputer.com/news/security/malicious-lolip0p-pypi-packages-install-info-stealing-malware/
Submission: On January 18 via api from DE — Scanned from DE
Submission: On January 18 via api from DE — Scanned from DE
Form analysis 4 forms found in the DOM
https://www.bleepingcomputer.com/search/
<form title="Search site" action="https://www.bleepingcomputer.com/search/">
<input type="hidden" name="cx" value="partner-pub-0920899300397823:3529943228">
<input type="hidden" name="cof" value="FORID:10">
<input type="hidden" name="ie" value="UTF-8">
<input type="search" name="q" aria-label="Search Site" placeholder="Search Site">
</form>https://www.bleepingcomputer.com/search/
<form action="https://www.bleepingcomputer.com/search/">
<input type="hidden" name="cx" value="partner-pub-0920899300397823:3529943228">
<input type="hidden" name="cof" value="FORID:10">
<input type="hidden" name="ie" value="UTF-8">
<input type="search" name="q" aria-label="Search Site" placeholder="Search Site">
</form>POST https://www.bleepingcomputer.com/forums/index.php?app=core&module=global§ion=login&do=process&return=https://www.bleepingcomputer.com/news/security/malicious-lolip0p-pypi-packages-install-info-stealing-malware/
<form action="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=login&do=process&return=https://www.bleepingcomputer.com/news/security/malicious-lolip0p-pypi-packages-install-info-stealing-malware/"
method="post">
<div class="bc_form_feild">
<label for="ips_username">Username</label>
<input aria-label="Enter login name" title="Enter login name" type="text" id="ips_username" name="ips_username" spellcheck="false" autocomplete="username">
</div>
<div class="bc_form_feild">
<label for="ips_password">Password</label>
<input aria-label="Enter login password" title="Enter login passwod" type="password" id="ips_password" name="ips_password" spellcheck="false" autocomplete="current-password">
</div>
<div class="bc_form_feild">
<div class="bc_remember">
<input id="remember" type="checkbox" name="rememberMe" value="1" checked="checked">
<label for="remember">Remember Me</label>
</div>
<div class="bc_anon">
<input id="anonymous" type="checkbox" name="anonymous" value="1">
<label for="anonymous">Sign in anonymously</label>
</div>
</div>
<div class="bc_btn_wrap">
<input type="hidden" name="auth_key" value="880ea6a14ea49e853634fbdc5015a024">
<input type="submit" aria-label="Login to site" title="Login" value="Login" class="bc_sub_btn">
<a aria-label="Sign in with Twitter" href="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=login&serviceClick=twitter&return=https://www.bleepingcomputer.com/news/security/malicious-lolip0p-pypi-packages-install-info-stealing-malware/" class="bc_twitter_btn"><img src="https://www.bleepstatic.com/images/site/login/twitter.png" width="28" height="24" alt="Sign in with Twitter button"> Sign in with Twitter</a>
<hr>
<p>Not a member yet? <a aria-label="Register account" title="Register account" href="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=register">Register Now</a></p>
</div>
</form><form>
<input type="hidden" id="comment-id-report" value="0">
<ul>
<li>
<label><input type="radio" name="comment-report-reason" value="Spam">Spam</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Abusive or Harmful">Abusive or Harmful</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Inappropriate content">Inappropriate content</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Strong language">Strong language</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Other">Other</label>
</li>
<li id="comment-report-other-reason-wrap" style="display:none;">
<textarea aria-label="Enter other reason for reporting the comment" rows="2" cols="2" id="comment-report-other-reason"></textarea>
</li>
</ul>
<p>Read our <a href="https://www.bleepingcomputer.com/posting-guidelines/">posting guidelinese</a> to learn what content is prohibited.</p>
</form>Text Content
WE VALUE YOUR PRIVACY
We and our partners store and/or access information on a device, such as cookies
and process personal data, such as unique identifiers and standard information
sent by a device for personalised ads and content, ad and content measurement,
and audience insights, as well as to develop and improve products.
With your permission we and our partners may use precise geolocation data and
identification through device scanning. You may click to consent to our and our
partners’ processing as described above. Alternatively you may access more
detailed information and change your preferences before consenting or to refuse
consenting. Please note that some processing of your personal data may not
require your consent, but you have a right to object to such processing. Your
preferences will apply to this website only. You can change your preferences at
any time by returning to this site or visit our privacy policy.
MORE OPTIONSAGREE
*
*
*
*
*
*
*
*
* News
* Featured
* Latest
* Datadog rotates RPM signing key exposed in CircleCI hack
* Malicious ‘Lolip0p’ PyPi packages install info-stealing malware
* Avast releases free BianLian ransomware decryptor
* Microsoft script recreates shortcuts deleted by bad Defender ASR rule
* Gain valuable skills by learning to code with this C course bundle
* Avast releases free BianLian ransomware decryptor
* Git patches two critical remote code execution security flaws
* Hackers turn to Google search ads to push info-stealing malware
* Downloads
* Latest
* Most Downloaded
* Qualys BrowserCheck
* STOPDecrypter
* AuroraDecrypter
* FilesLockerDecrypter
* AdwCleaner
* ComboFix
* RKill
* Junkware Removal Tool
* Virus Removal Guides
* Latest
* Most Viewed
* Ransomware
* Remove the Theonlinesearch.com Search Redirect
* Remove the Smartwebfinder.com Search Redirect
* How to remove the PBlock+ adware browser extension
* Remove the Toksearches.xyz Search Redirect
* Remove Security Tool and SecurityTool (Uninstall Guide)
* How to remove Antivirus 2009 (Uninstall Instructions)
* How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo
* How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using
TDSSKiller
* Locky Ransomware Information, Help Guide, and FAQ
* CryptoLocker Ransomware Information Guide and FAQ
* CryptorBit and HowDecrypt Information Guide and FAQ
* CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ
* Tutorials
* Latest
* Popular
* How to open a Windows 11 Command Prompt as Administrator
* How to make the Start menu full screen in Windows 10
* How to install the Microsoft Visual C++ 2015 Runtime
* How to open an elevated PowerShell Admin prompt in Windows 10
* How to start Windows in Safe Mode
* How to remove a Trojan, Virus, Worm, or other Malware
* How to show hidden files in Windows 7
* How to see hidden files in Windows
* Deals
* Categories
* eLearning
* IT Certification Courses
* Gear + Gadgets
* Security
* Forums
* More
* Startup Database
* Uninstall Database
* Glossary
* Chat on Discord
* Send us a Tip!
* Welcome Guide
* Home
* News
* Security
* Malicious ‘Lolip0p’ PyPi packages install info-stealing malware
* AddThis Sharing Buttons
Share to FacebookFacebookShare to TwitterTwitterShare to
LinkedInLinkedInShare to RedditRedditShare to Hacker NewsHacker NewsShare to
EmailEmail
*
MALICIOUS ‘LOLIP0P’ PYPI PACKAGES INSTALL INFO-STEALING MALWARE
By
BILL TOULAS
* January 16, 2023
* 11:41 AM
* 1
A threat actor has uploaded to the PyPI (Python Package Index) repository three
malicious packages that carry code to drop info-stealing malware on developers'
systems.
The malicious packages, discovered by Fortinet, were all uploaded by the same
author named 'Lolip0p' between January 7 and 12, 2023. Their names are
'colorslib,' 'httpslib,' and 'libhttps.' All three have been reported and
removed from the PyPI.
PyPI is the most widely used repository for Python packages that software
developers use to source the building blocks of their projects.
1/1 Skip Ad Continue watching after the ad Visit Advertiser websiteGO TO PAGE
PLAY Top Stories Video Settings Full Screen About Connatix V215143 Read More
Read More Read More Read More Read More Read More Avast releases free
BianLianransomware decryptor
Unfortunately, its popularity makes it a attractive for threat actors targeting
developers or their projects. Typically, malicious packages are uploaded
masquerading as something useful or they mimic renowned projects by modifying
their name.
PyPI doesn't have the resources to scrutinize all package uploads, so it relies
on user reports to find and remove malicious files. By the time they are
deleted, though, the bad packages usually count several hundred downloads.
NEW CAMPAIGN
Contrary to the typical malicious uploads on PyPI, the trio that Fortinet
discovered features complete descriptions, which helps trick developers into
believing they're genuine resources.
Malicious package description on PyPI (Fortinet)
In this case, the names of the packages do not mimic other projects but seek to
convince they come with reliable, risk-free code.
According to PyPI package stat counting service 'pepy.tech,' the three malicious
entries had the following download counts by the time they were removed on
Sunday, January 14.
* Colorslib – 248 downloads
* httpslib – 233 downloads
* libhttps – 68 downloads
Although the number of downloads may seem small, the potential impact of these
infections as part of a supply chain makes them significant.
All three packages feature the same malicious 'setup.py' file that attempts to
run PowerShell that fetches an executable from a suspicious URL, named
'Oxyz.exe.' This piece of malware steals browser information.
BleepingComputer found that Oxyz.exe is also spread as a free Discord Nitro
generator.
That second file is flagged by a few vendors on VirusTotal as
malicious. Fortinet says 'update.exe' drops several additional files on the
host, one of which ('SearchProtocolHost.exe'), which is flagged as malicious by
some AV vendors as an info-stealer.
Files 'update.exe' drops on the host (Fortinet)
Looking a little further, BleepingComputer found that at least one of the
dropped processes is used to collect Discord tokens, suggesting that is part of
a general information-stealing malware campaign used to steal browser data,
authentication tokens, and other data from an infected device.
The detection rates for all three executables used in this attack are quite low,
ranging between 4.5% and 13.5%, allowing the malicious files to evade detection
from multiple security agents that may be running on the victim host.
Detection results for 'update.exe' on VirusTotal (Fortinet)
Unfortunately, even after removing those packages from the PyPI, threat actors
can still re-upload them at a later time under a different name.
To ensure the safety and security of their projects, software developers should
pay attention selecting packages for download. This includes checking the
package's authors and reviewing the code any suspicious or malicious intent.
RELATED ARTICLES:
Malicious ‘SentinelOne’ PyPI package steals data from developers
Malicious PyPi packages create CloudFlare Tunnels to bypass firewalls
PyTorch discloses malicious dependency chain compromise over holidays
Hackers bombard PyPi platform with information-stealing malware
Over 1,300 fake AnyDesk sites push Vidar info-stealing malware
* Information Stealer
* Malware
* PyPI
* Python
* Software
* Facebook
* Twitter
* LinkedIn
* Email
*
BILL TOULAS
Bill Toulas is a technology writer and infosec news reporter with over a decade
of experience working on various online publications. An open source advocate
and Linux enthusiast, is currently finding pleasure in following hacks, malware
campaigns, and data breach incidents, as well as by exploring the intricate ways
through which tech is swiftly transforming our lives.
* Previous Article
* Next Article
COMMENTS
* DELEMIADES - 1 DAY AGO
*
*
Hi,
so, which is it? Oxyz.exe or Oxzy.exe? People at Fortinet can't make up their
minds.
POST A COMMENT COMMUNITY RULES
YOU NEED TO LOGIN IN ORDER TO POST A COMMENT
Not a member yet? Register Now
YOU MAY ALSO LIKE:
Popular Stories
* MSI accidentally breaks Secure Boot for hundreds of motherboards
* Microsoft script recreates shortcuts deleted by bad Defender ASR rule
FOLLOW US:
*
*
*
*
*
MAIN SECTIONS
* News
* Downloads
* Virus Removal Guides
* Tutorials
* Startup Database
* Uninstall Database
* Glossary
COMMUNITY
* Forums
* Forum Rules
* Chat
USEFUL RESOURCES
* Welcome Guide
* Sitemap
COMPANY
* About BleepingComputer
* Contact Us
* Send us a Tip!
* Advertising
* Write for BleepingComputer
* Social & Feeds
* Changelog
Terms of Use - Privacy Policy - Ethics Statement
Copyright @ 2003 - 2023 Bleeping Computer® LLC - All Rights Reserved
LOGIN
Username
Password
Remember Me
Sign in anonymously
Sign in with Twitter
--------------------------------------------------------------------------------
Not a member yet? Register Now
REPORTER
HELP US UNDERSTAND THE PROBLEM. WHAT IS GOING ON WITH THIS COMMENT?
* Spam
* Abusive or Harmful
* Inappropriate content
* Strong language
* Other
*
Read our posting guidelinese to learn what content is prohibited.
Submitting...
SUBMIT