Malicious PyPI packages abuse Gmail, websockets to hijack systems

Seven malicious PyPi packages were found using Gmail's SMTP servers and WebSockets for data exfiltration and remote command execution. The packages were discovered by Socket's threat research team, who reported their findings to the PyPI, resulting in the removal of the packages. However, some of these packages were on PyPI for over four years, and based on third-party download counters, one was downloaded over 18,000 times. Here's the complete list shared by Socket: The 'Coffin' packages appear to be impersonating the legitimate Coffin package that serves as a lightweight adapter for integrating Jinja2 templates into Django projects. The malicious functionality Socket discovered in these packages centers on covert remote access and data exfiltration through Gmail. The packages used hardcoded Gmail credentials to log into the service's SMTP server (smpt.gmail.com), sending reconnaissance information to allow the attacker to remotely access the compromised system. As Gmail is a trusted service, firewalls and EDRs are unlikely to flag this activity as suspicious. After the email signaling stage, the implant connects to a remote server using WebSocket over SSL, receiving tunnel configuration instructions to establish a persistent, encrypted, bidirectional tunnel from the host to the attacker. Using a 'Client' class, the malware forwards traffic from the remote host to the local system through the tunnel, allowing internal admin panel and API access, file transfer, email exfiltr...