An NPM and PyPI Malicious Campaign Targeting Windows Users
Essential information
- Published
- 26/11/2024 21:06
- Modified
- 26/11/2024 21:34
- Tags
- 2024-11-26 infostealer npm pypi roblox supply-chain typosquatting
- Related entities
- 11 observables, 1 intrusion sets (apt), 10 techniques (mitre), 2 malware
Description
Datadog Security Research has uncovered an ongoing supply chain attack targeting both npm and PyPi package repositories, tracked as MUT-8694. This campaign uses malicious packages to deliver infostealer malware to Windows users, leveraging legitimate services like GitHub and repl.it for payload hosting. The threat actor employs typosquatting and targets developers, particularly those working with Roblox. Two main malware types are deployed: Blank Grabber and Skuld Stealer, both open-source projects with capabilities to steal credentials, crypto wallets, and other sensitive information. The campaign demonstrates sophistication in its multi-ecosystem approach and persistence, highlighting the growing risk to open-source package repositories.