Over 170K users caught up in poisoned Python package ruse

More than 170,000 users are said to have been affected by an attack using fake Python infrastructure with "successful exploitation of multiple victims." According to CheckMarx, members of the Top.gg GitHub organization – a top resource for Discord bot makers – as well as other developers were targeted, and it all hinged on various supply chain attack techniques to distribute malware-infected Python PyPI packages. That malware stole data from people's browsers, Discord app, crypto wallets, and files that matched certain keywords. As of now, it's not clear where this data was sent. There were multiple prongs to this remarkably complicated attack: clones of popular Python packages such as Colorama, a doppelganger or typosquatted domain for Python packages, and code obfuscation. Also reported are account break-ins across trusted GitHub community members. All of these tactics were used to successfully steal user data from an undetermined number of developers. The malicious Python packages were uploaded in November 2022, but the attack didn't start in earnest until last February when the doppelganger domain was registered. The official PyPI domain is pythonhosted.org, though the similar pypihosted domain (now taken down by Cloudflare) was available and the attacker registered it. The attacker made sure that real URL and the fake URL strings looked nearly identical. In fact, the only difference between the two was the domain name, pythonhosted versus pypihosted. The fake Python pack...