- Security researchers found three malicious PyPI packages
- The packages had around 7,000 downloads
- They were designed to check for active email accounts
Security researchers have found some of the tools cybercriminals are using to steal people’s Instagram and TikTok accounts – on PyPI.
The Python Package Index (PyPI), one of the world’s biggest repositories of Python code, is often abused to holst malicious code, or trick software developers into downloading and running tainted code in their projects.
In this case, security researchers from Socket found three packages, named “checker-SaGaF”, “steinlurks”, and “sinnercore”. Cumulatively, these three had around 7,000 downloads before being pulled from the platform.
Credential stuffing and password spraying
The first two acted as email address validators, cross-referencing supplied email addresses with TikTok and Instagram APIs, to see if they are associated with accounts on the platform. While simply checking if an email address is valid doesn’t seem to be particularly harmful, it is an important step in cybercriminal activity, the researchers explained.
“Once threat actors have this information, just from an email address, they can threaten to dox or spam, conduct fake report attacks to get accounts suspended, or solely confirm target accounts before launching a credential stuffing or password spraying exploit,” said Socket’s Olivia Brown.
“Validated user lists are also sold on the dark web for profit. It can seem harmless to construct dictionaries of active emails, but this information enables and accelerates entire attack chains and minimizes detection by only targeting known-valid accounts.”
The third package, “sinnercore”, triggers the “forgot password” flow for a given username on Instagram.
The news comes roughly a month after researchers found two malicious packages on PyPI, posing as fixes for a popular, legitimate package. The malware was designed to steal people’s cryptocurrency, which is a popular attack vector on PyPI. In this case, the legitimate package is used in building “hot wallets” – software wallets for cryptocurrencies. Despite being obvious malware, the two packages still managed to rake in more than 37,000 downloads before being pulled.
Via The Hacker News
