Unveiling BlazeStealer Malware Python Packages on PyPI

Wajahat Raja

November 22, 2023 - TuxCare expert team

In a recent revelation, a cluster of malicious Python packages has infiltrated the Python Package Index (PyPI), posing a significant threat to developers’ systems by aiming to pilfer sensitive information. These deceptive packages, initially appearing as innocuous obfuscation tools, conceal a potent malware named BlazeStealer. In this blog post, we’ll cover the details of BlazeStealer Malware Python Packages on PyPI, as well as provide all updates regarding the cybersecurity issue.

The Covert Operation: BlazeStealer Malware Python Packages

Security researcher Yehuda Gelb sheds light on BlazeStealer malware discovery, stating that it retrieves an additional malicious script from an external source. This script empowers a Discord bot, providing attackers with full control over the victim’s computer. The campaign, initiated in January 2023, comprises eight packages: Pyobftoexe, Pyobfusfile, Pyobfexecute, Pyobfpremium, Pyobflite, Pyobfadvance, Pyobfuse, and pyobfgood, the latter being published in October.

Cybersecurity News BlazeStealer Installation Tactics

These malicious modules include setup.py and init.py files that are designed to retrieve a Python script located on transfer[.]sh. Once installed, this script runs immediately, launching BlazeStealer onto the victim’s PC. The capabilities of Python malware on PyPI include running a Discord bot, enabling the theft of sensitive data, executing arbitrary commands, encrypting files, and even disabling Microsoft Defender Antivirus on the compromised host.

Destructive Arsenal of BlazeStealer

The BlazeStealer cybersecurity threat goes beyond data theft, rendering the computer inoperable by escalating CPU usage, inserting a Windows Batch script in the startup directory to force a shutdown, and, in extreme cases, inducing a blue screen of death (BSOD) error. The PyPI security breach underscores the urgency for developers to remain vigilant and proactive in their security measures.

Developers as Prime Targets

Gelb emphasizes that developers engaged in code obfuscation likely handle valuable and sensitive information. Consequently, hackers perceive them as lucrative targets. The malicious actors exploit the trust placed in open-source packages by developers, making it imperative for the coding community to exercise caution and thoroughly vet packages before integration.

Geographic Impact and Magnitude

According to the BlazeStealer malware analysis, a significant number of downloads associated with these rogue packages originated from the U.S., followed by China, Russia, Ireland, Hong Kong, Croatia, France, and Spain. Impressively, these packages garnered a total of 2,438 downloads before their removal from PyPI. This geographic diversity in downloads highlights the global reach and impact of such cyber threats.

Cautionary Tale for Open-Source Development

BlazeStealer’s infiltration into PyPI aligns with a broader trend observed by software supply chain security firm Phylum. They recently uncovered a collection of crypto-themed npm modules with the capability to discreetly deliver next-stage malware. The Evolution of Software Supply Chain Security Report for Q3 2023 by Phylum reveals alarming statistics, with 13,708 packages across various ecosystems found executing suspicious code during installation.

Vigilance in the Open-Source Realm

The report on PyPI malware detection further exposes that 1,481 packages surreptitiously downloaded and executed code from remote sources. Additionally, 10,201 packages referenced known malicious URLs, and 2,598 typosquat packages were identified. This emphasizes the importance of maintaining vigilance and implementing robust security measures when engaging with open-source repositories.

Conclusion

As the open-source domain continues to be a breeding ground for innovation, it simultaneously becomes a potential playground for threat actors. The BlazeStealer incident serves as a stark reminder to developers for protecting against Python package malware, exercising caution, conducting thorough package vetting, and staying updated on emerging security threats. By adopting a proactive approach to cybersecurity, the developer community can collectively contribute to a more secure and resilient software landscape.

In conclusion, Python package security requires a combination of awareness, diligence, and proactive security measures. The BlazeStealer malware incident underscores the need for continuous vigilance and collaboration within the developer community to mitigate the evolving threats present in the open-source ecosystem.

The sources for this piece include articles in The Hacker News and Security Week.

Summary