Hackers hijack Python packages once again to spread dangerous malware

Hackers are once again targeting Python developers involved in the blockchain industry in an attempt to distribute malware and steal tokens.

A new report from cybersecurity researchers at Checkmarx outlines how they observed an account on PyPI uploading multiple packages within a very short timeframe.

This unnamed individual uploaded a handful of packages with similar names: “AtomicDecoderss”, “TrustDecoderss”, “WalletDecoderss”, and more. The packages are presented as tools for decoding and managing data from different cryptocurrency wallets. On the surface, they look like super useful tools, especially for people in need of crypto wallet recovery, or management.

Malicious intent

Depending on the name, the packages are designed for separate wallets: Atomic, Trust Wallet, MetaMask, Ronin, Exodus, TronLink, and others. The ones mentioned here are some of the most popular wallets out there, especially MetaMask and Atomic.

Their true purpose, however, is malicious - they work in the background ...