Open Source 2022-08-24 · 0 days ·Infostealer, Credential Theft

spam PyPI phishing shipped malware

Part of the JuiceLedger phished PyPI maintainers campaign

JuiceLedger used phished PyPI credentials to publish malicious spam 2.0.2 and 4.0.2. The releases collected environment data and ran a downloaded trojan at install time.

Story

spam was one of the legitimate PyPI projects hit during the JuiceLedger phishing campaign. The attacker did not have to create a lookalike package or wait for a typo. Stolen maintainer credentials gave them the ability to publish under the real spam project name.

The poisoned releases were versions 2.0.2 and 4.0.2. Like the companion exotel compromise, the malicious code ran during package installation, collected host and environment details, contacted attacker-controlled infrastructure, and downloaded a larger trojan payload.

That made the exposure surface broader than production applications that explicitly imported spam. Developer machines, build jobs, and automated dependency refreshes could execute the setup path simply by resolving and installing the package from PyPI.

PyPI removed the malicious releases and advisories were published through GitHub, PyPA, and GitLab. This page keeps the record narrow to the real spam package compromise; the broader JuiceLedger activity also included exotel and a large typosquat cleanup campaign.

Affected Artifacts

Incident Context

Motive
Credential Theft
Attribution
Group
Cause
Compromised Account Credentials
Transitive
No
Actor
JuiceLedger
User Impact
200000

External References

Source record: oss/attacks/spam/meta.yaml