A new advisory by SentinelLabs and Checkmarx has linked a threat actor called ‘JuiceLedger’ to the first known phishing campaign targeting Python Package Index (PyPI) users.
The repository’s Twitter account first described its initial findings about the campaign on August 24, 2022 in a series of posts.
Roughly a week later, SentinelLabs is now expanding on PyPI’s discovery, saying JuiceLedger began running moderately low-key campaigns since early 2022.
These attacks relied on fraudulent Python installer applications with ‘JuiceStealer,’ a .NET software designed to steal sensitive data from victims’ browsers.
According to the advisory, in August 2022, JuiceLedger then engaged in poisoning open-source packages as a way to target a wider audience with the info stealer through a supply chain attack.
“The attack on PyPI in August involves a far more complex attack chain, including phishing emails to PyPI developers, typo-squatting, and malicious packages intended to infect downstream users with the JuiceStealer malware,” wrote the security researchers.
“This vector seems to be utilized in parallel to the earlier JuiceLedger infection method, as similar payloads were delivered around the same time through fake cryptocurrency ledger websites.”
These new tactics raised the threat level posed by this group considerably, said SentinelLabs.
“JuiceLedger operators have actively targeted PyPi package contributors in a phishing campaign, successfully poisoning at least two legitimate packages with malware. Several hundred more malicious packages are known to have been typo-squatted.”
To mitigate the impact of these attacks, PyPI said that they are actively reviewing reports of malicious packages and have taken down several hundred typo-squats. The repository also urged package maintainers to turn on two-factor authentication (2FA).
As for JuiceLedger, the SentinelLabs advisory said the threat actor appears to have evolved very quickly over the last few months.
“The escalation in complexity in the attack on PyPI contributors, involving a targeted phishing campaign, hundreds of typo-squatted packages and account takeovers of trusted developers, indicates that the threat actor has time and resources at their disposal,” reads the document.
“Given the widespread use of PyPI and other open source packages in enterprise environments, attacks such as these are a cause of concern and security teams are urged to review the provided indicators and take appropriate mitigation measures.”