# This Week in Malware - A PyPI Phishing Follow-Up Plus 120 Packages **September 02, 2022** By [Aaron Linskens](/content/blog/author/aaron-linskens/index.html) This week in malware, we discovered and analyzed 120 packages flagged as malicious, suspicious, or dependency confusion attacks. As a follow-up to [our coverage last week](/content/blog/this-week-in-malware-aug-26-22/index.html), new details emerged regarding a phishing campaign that sought to steal account credentials of PyPI maintainers and lace their packages with malware. ## Phishing Caught Up in a Larger Scheme An investigation of the malicious email campaign that plagued PyPI maintainers last week connected the phishing to part of a multi-step saga, rather than a one-off trip. SentinelOne and Checkmarx published [a report yesterday](https://www.sentinelone.com/labs/pypi-phishing-campaign-juiceledger-threat-actor-pivots-from-fake-apps-to-supply-chain-attacks/) that detailed how the threat actor behind the phishing upgraded from small-scale fraudulent applications and typosquatting to [software supply chain](/content/resources/articles/what-is-software-supply-chain/index.html) attacks throughout the year. Security researchers at the companies identified a threat actor group named "JuiceLedger" as the perpetrator of last week's phishing campaign. Researchers said the PyPI supply chain attack was the most recent malicious activity in a larger campaign carried out by the group. Accordingly, the group attempts to distribute a .NET-based malware, dubbed "JuiceStealer," that steals credential, browser, and cryptocurrency vault information and feeds the ill-gotten goods to a domain (linkedopports[\.]com) purportedly controlled by JuiceLedger. JuiceStealer first appeared on VirusTotal in February 2022, with early iterations of the malware delivered via fake Python installer applications. Later in the year, JuiceLedger apparently pivoted to packaging its malware in fraudulent crypto-themed applications. Researchers described these as "delivered in a similar scheme to the Python installer" and "embedded within a zip file with additional legitimate software." By August 2022, JuiceLedger escalated its threat efforts to supply chain attacks by targeting PyPI maintainers with poisoned open source packages. [As we covered last week](/content/blog/this-week-in-malware-aug-26-22/index.html), this malware attempts to deliver a phishing email purporting a validation process, which steals login credentials and subsequently drops malware into the packages of unsuspecting PyPI maintainers. Researchers traced these different methods back to JuiceLedger due to common tactics, in addition to the disparate stolen information sent to the supposed JuiceLedger-owned domain. ## Malicious Packages Caught by Sonatype This Week We caught the following this week via Sonatype's [automated malware detection system](/content/press-releases/next-generation-nexus-intelligence/index.html), offered as part of [Sonatype Firewall](/content/products/sonatype-repository-firewall/index.html): - @nitingawandi/piw-utils-internal - @snapptinc/fraud-platform **Pypi Malicious Packages** - advertising-interface-lib - alchemix-v2-ui - ambire-common - antchain-sdk-abcdjb - antchain-sdk-abcdjb1 - antchain-sdk-acc - antchain-sdk-account - antchain-sdk-acm - antchain-sdk-acs-iot - antchain-sdk-apigateway - antchain-sdk-arec - antchain-sdk-baas-midway - antchain-sdk-baasplus - antchain-sdk-billing - antchain-sdk-blockchain - antchain-sdk-cafecmdb - antchain-sdk-cas - antchain-sdk-cat - antchain-sdk-commercial - antchain-sdk-commercialexternal - antchain-sdk-das - antchain-sdk-dog - antchain-sdk-donpa - antchain-sdk-ebc - antchain-sdk-ent - antchain-sdk-gatewayx - antchain-sdk-goodschain - antchain-sdk-iam - antchain-sdk-industry - antchain-sdk-ldc - antchain-sdk-loadtestmock - antchain-sdk-mq - antchain-sdk-ms - antchain-sdk-mytc - antchain-sdk-notification - antchain-sdk-op - antchain-sdk-osp - antchain-sdk-pcc - antchain-sdk-propertychain - antchain-sdk-realperson - antchain-sdk-rms - antchain-sdk-saas - antchain-sdk-shuziwuliu - antchain-sdk-sp - antchain-sdk-stlr - antchain-sdk-tam - antchain-sdk-tdm - antchain-sdk-tftus - antchain-sdk-trade - antchain-sdk-trdemo - antchain-sdk-twoe - antchain-sdk-yunqing - antchain-sdk-zjlm - antchain-sdk-zolozfaceverify - antcloud1111-node-stack - ccsv - cdm-one - Malicious Package - ceshia-node-stack - contextliv - corplogger - credential-provider-env - credential-provider-ini - credential-provider-node - credential-provider-process - cryptographyy - csvv - cvs - download-youtube-subtitle - epic-ue-marketo - epic-ue-search - epic-unreal-engine - eslint-config-zpi - eslint-pluhin-flipper-one-12315 - flak7 - flak8 - flake7 - fuzywuzy - fuzywuzzy - fuzzywuzy - fuzzzywuzzy - handlebars-inline-precompile - hreading - khaledsakr - laysound - loyalty-scratch-card-ui - mcbinding - middleware-bucket-endpoint - middleware-sdk-s3 - my-little-snippet - nibushidao-dsda-sa - okta-i18n-bundles - optly-components - playsoun - ptokens-erc20-vault-smart-contract - pyinstaler - raw-tool - release-utils-internal - rgparse - snappt-fraud - suqin-node-stack - suqinaatest - test-npm-mal-kfir - threadin - threeding - tslint1a - typingdna - uniswapmempool - uzzywuzzy - we3 - wec3 - weg3 - wen3 - wl-global-services - wl-layout - wl-shell-layout - yextrce - zlp-testlib These discoveries follow [our report last week](/content/blog/this-week-in-malware-aug-26-22/index.html) of an extensive list of discovered malware, as well as a phishing campaign against PyPI maintainers. ## Turn on Sonatype Firewall for Automatic Protection As a [DevSecOps](/content/resources/articles/what-is-devsecops/index.html) organization, we remain committed to identifying and halting attacks, such as those mentioned above, against open source developers and the wider software supply chain. Users of Sonatype Firewall can rest easy knowing that such malicious packages would automatically be blocked from reaching their development builds. Sonatype Firewall instances will automatically quarantine any suspicious components detected by our automated malware detection systems, while a researcher is in progress, thereby keeping your software supply chain protected from the start. Sonatype's world-class security research data, combined with our [automated malware detection](/content/press-releases/next-generation-nexus-intelligence/index.html) technology, protects your developers, customers, and software supply chain from infections. Written by **Aaron Linskens** Aaron is a technical writer at Sonatype. He works at a crossroads of technical writing, developer advocacy, and information design. He aims to get developers and non-technical collaborators to work better together in solving problems and building software.