Image:
Malicious Python packages found exfiltrating user data to Telegram bot
Researchers at security vendor Checkmarx have uncovered an operation, apparently based in Iraq, that uses malware hosted on the Python repository PyPI to search for files on the victim's device and exfiltrate them to a Telegram bot.
The malicious packages, all of which now seem to have been removed from PyPI, were named testbrojct2, proxyfullscraper, proxyalhttp and proxyfullscrapers. The packages contained an __init__.py ...
To continue reading this article...
Join Computing
- Unlimited access to real-time news, analysis and opinion from the technology industry
- Receive important and breaking news in our daily newsletter
- Be the first to hear about our events and awards programmes
- Join live member only interviews with IT leaders at the ‘IT Lounge’; your chance to ask your burning tech questions and have them answered
- Access to the Computing Delta hub providing market intelligence and research
- Receive our members-only newsletter with exclusive opinion pieces from senior IT Leaders
