PyPI Introduces Archival Status to Alert Users About Unmaintained Python Packages - Related to pypi, accounts, packages, ads, go

Malicious Go Package Exploits Module Mirror Caching for Persistent Remote Access

Cybersecurity researchers have called attention to a software supply chain attack targeting the Go ecosystem that involves a malicious package capable of granting the adversary remote access to infected systems.

The package, named [website], is a typosquat of the legitimate BoltDB database module ([website], per Socket. The malicious version ([website] was , following which it was cached indefinitely by the Go Module Mirror service.

"Once installed, the backdoored package grants the threat actor remote access to the infected system, allowing them to execute arbitrary commands," security researcher Kirill Boychenko stated in an analysis.

Socket expressed the development marks one of the earliest instances of a malicious actor abusing the Go Module Mirror's indefinite caching of modules to trick people into downloading the package. Subsequently, the attacker is expressed to have modified the Git tags in the source repository in order to redirect them to the benign version.

This deceptive approach ensured that a manual audit of the GitHub repository did not reveal any malicious content, while the caching mechanism meant that unsuspecting developers installing the package using the go CLI continued to download the backdoored variant.

"Once a module version is cached, it remains accessible through the Go Module Proxy, even if the original source is later modified," Boychenko noted. "While this design benefits legitimate use cases, the threat actor exploited it to persistently distribute malicious code despite subsequent changes to the repository."

"With immutable modules offering both security benefits and potential abuse vectors, developers and security teams should monitor for attacks that leverage cached module versions to evade detection."

The development comes as Cycode detailed three malicious npm packages – serve-static-corell, openssl-node, and next-refresh-token – that harbored obfuscated code to collect system metadata and run arbitrary commands issued by a remote server ("[website][.]60") on the infected host.

Amazon has unveiled key security enhancements for Redshift, a popular data warehousing solution, to...

Netgear has fixed two critical vulnerabilities affecting multiple WiFi router models and urged custo...

Microsoft has released patches to address two Critical-rated security flaws impacting Azure AI Face ...

Malvertising Scam Uses Fake Google Ads to Hijack Microsoft Advertising Accounts

Cybersecurity researchers have discovered a malvertising campaign that's targeting Microsoft advertisers with bogus Google ads that aim to take them to phishing pages that are capable of harvesting their credentials.

"These malicious ads, appearing on Google Search, are designed to steal the login information of individuals trying to access Microsoft's advertising platform," Jérôme Segura, senior director of research at Malwarebytes, expressed in a Thursday study.

The findings came a few weeks after the cybersecurity business exposed a similar campaign that leveraged sponsored Google Ads to target individuals and businesses advertising via the search giant's advertising platform.

At the same time, the threat actors behind the campaign employ several techniques to evade detection by security tools. This includes redirecting traffic originating from VPNs to a phony marketing website. Site visitors are also served Cloudflare challenges in an attempt to filter out bots.

Last but not least, customers who attempt to directly visit the final landing page ("ads.mcrosoftt[.]com") are rickrolled by redirecting them to a YouTube video linked to the famous internet meme.

The phishing page is a lookalike version of its legitimate counterpart ("ads.microsoft[.]com") that's designed to capture the victim's login credentials and two-factor authentication (2FA) codes, granting the attackers the ability to hijack their accounts.

Malwarebytes stated it identified additional phishing infrastructure targeting Microsoft accounts going back to a couple of years, suggesting that the campaign has been ongoing for some time and that it may have also targeted other advertising platforms like Meta.

Another notable aspect is that a majority of the phishing domains are either hosted in Brazil or have the "[website]" Brazilian top-level domain, drawing parallels to the campaign aimed at Google Ads customers, which was predominantly hosted on the ".pt" TLD.

Google previously told The Hacker News that it takes steps to prohibit ads that seek to dupe clients with the goal of stealing their information, and that it has been actively working to enforce countermeasures against such efforts.

"We expressly prohibit ads that aim to deceive people and we suspend advertisers' accounts if they are found to engage in this practice, as we have done here," a Google spokesperson told the publication when reached for comment.

The disclosure follows the emergence of an SMS phishing campaign that employs failed package delivery lures to exclusively target mobile device customers by impersonating the United States Postal Service (USPS).

"This campaign employs sophisticated social engineering tactics and a never-before-seen means of obfuscation to deliver malicious PDF files designed to steal credentials and compromise sensitive data," Zimperium zLabs researcher Fernando Ortega stated in a investigation .

The phishing page is also equipped to capture their payment card details under the guise of a service charge for redelivery. The entered data is then encrypted and transmitted to a remote server under the attacker's control. As many as 20 malicious PDFs and 630 phishing pages have been detected as part of the campaign, indicating a large-scale operation.

The activity is a sign that cybercriminals are exploiting security gaps in mobile devices to pull off social engineering attacks that capitalize on individuals' trust in popular brands and official-looking communications.

Similar USPS-themed smishing attacks have also utilized Apple's iMessage to deliver the phishing pages, a technique known to be adopted by a Chinese-speaking threat actor known as, Smishing Triad.

It's worth noting that this approach has been previously associated with a phishing-as-a-service (PhaaS) toolkit named Darcula, which has been used to extensively target postal services like USPS and other established organizations in more than 100 countries.

"The scammers have constructed this attack relatively well, which is probably why it's being seen so often in the wild," Huntress researcher Truman Kain presented. "The simple truth is it's working."

(The story was updated after publication to include a statement from Google.).

Meta-owned WhatsApp on Friday expressed it disrupted a campaign that involved the use of spyware to target journalists and civil society members.

The [website] Cybersecurity and Infrastructure Security Agency (CISA) and the Food and Drug Administration (FDA) have issued alerts about the presence of h......

PyPI Introduces Archival Status to Alert Users About Unmaintained Python Packages

The maintainers of the Python Package Index (PyPI) registry have showcased a new feature that allows package developers to archive a project as part of efforts to improve supply chain security.

"Maintainers can now archive a project to let people know that the project is not expected to receive any more updates," Facundo Tuesca, senior engineer at Trail of Bits, noted.

In doing so, the idea is to clearly signal to developers that the Python libraries are no longer being actively maintained and that no future security fixes or product updates should be expected.

That expressed, projects labeled as archived will continue to remain available on PyPI and clients can continue to install it without any issues.

In a separate blog post detailing the feature, Tuesca stated the maintainers are considering additional maintainer-controlled statuses to superior communicate a project's status to downstream consumers.

PyPI also recommends that package developers release a final version prior to archival by updating the project description to warn customers and to include alternatives as replacement.

The development comes shortly after PyPI rolled out the ability to quarantine projects, allowing administrators to mark a project as potentially suspicious and prevent it from being installed by other people to prevent further harm.

In November 2024, PyPI administrators quarantined the Python library aiocpa after a new revision was found to include malicious code designed to exfiltrate private keys via Telegram.

Since August of last year, approximately 140 projects have been quarantined and subsequently removed from the registry barring one.

"Having this intermediary stage enables PyPI Admins to create more safety for end individuals, protecting end individuals quicker by PyPI Admins removing a suspicious package from being installed, while allowing further investigation," PyPI Admin Mike Fiedler stated.

"Since project removal from PyPI is a destructive action, creating a quarantine state allows for restoring a project if deemed a false positive research without destroying any of the project's history or metadata."

[website] turns 15 years old today! Maybe it’s indelicate to celebrate the birthday of a c...

The payment card giant MasterCard just fixed a glaring error in its domain name server settings that...

Netgear has fixed two critical vulnerabilities affecting multiple WiFi router models and urged custo...