Open Source 2022-08-24 · 0 days ·Data Exfiltration

exotel PyPI phishing shipped malware

Part of the JuiceLedger phished PyPI maintainers campaign

JuiceLedger used phished PyPI credentials to publish malicious exotel 0.1.6. The release collected environment data and ran a downloaded trojan at install time.

Story

exotel was one of the packages caught in the 2022 JuiceLedger PyPI phishing wave. The attacker did not need to impersonate the package name. They obtained publishing access and uploaded version 0.1.6 to the real PyPI project.

The malicious release executed during installation. Its setup code collected environment data from the host and reached out to attacker infrastructure, then downloaded and executed a second-stage payload. That made developer machines and CI runners the primary exposure surface, because the code ran before any exotel application logic had to be invoked.

The campaign was notable because it targeted maintainers through PyPI-themed phishing rather than package consumers directly. Once credentials were stolen, PyPI became the distribution system for code that looked ordinary by package coordinate but hostile by content.

The affected release was removed and advisories were published through GitHub and PyPA. This record stays package-specific because the JuiceLedger campaign hit more than one project, but the affected version, hashes, and package archive here are specific to exotel.

Affected Artifacts

exotel

pypi · repository · Source Archive
Observed
2022-08-24
Compromised Versions
Fixed
Not listed
Hashes
  • sha256:fbb13333b05eaab13d5d4810f92dbd5dfc4c25cf14e4471c6352b046c6653b6f
  • sha256:60434af3ebe924efabc96558e6c8d8176bf4eb06dd6cc47b4c491da9964be874
  • sha256:8e97c6883e7af5cc1f88ac03197d62298906ac4a35a789d94cc9fde45ee7ea13

Incident Context

Motive
Credential Theft
Attribution
Group
Cause
Compromised Account Credentials
Transitive
No
Actor
JuiceLedger
User Impact
480000

External References

Source record: oss/attacks/exotel/meta.yaml