Cybersecurity researchers from Phylum have discovered a brand new type of malware in a PyPI package deal that was utilizing Unicode to cover.

Unicode is a worldwide encoding commonplace used for various languages and scripts, overlaying greater than 100,000 characters, whose aim is to simplify and streamline how characters are seen in digital and digital gadgets. With Unicode, each letter, digit, and image, get a novel numeric worth, that stays the identical, whatever the program or platform in use.

The malware is named “onyxproxy”, it’s an infostealer on the hunt for developer login credentials and authentication tokens. It was out there on PyPI for every week, earlier than being shut down, and through that point, it managed to get 183 downloads, which means that as much as 183 totally different builders are susceptible to credential and id theft.

Hiding in plain sight

The malware carries a package deal known as “setup.py” which, in keeping with the researchers, has “hundreds” of suspicious code strings which use a mix of Unicode characters. 

Noticed on the floor, the characters look regular and benign – nevertheless, what the human eye sees, and what this system sees, are two vastly various things.

In onyxproxy, there are three important identifiers: “__import__”, “subprocees”, and “CryptoUnprotectData”. These have a lot of variants, which makes them ideally suited for beating string-matching-based defenses, the researchers clarify. 

Whereas the approach may sound difficult, the researchers declare it isn’t precisely subtle. Nevertheless, ought to the abuse of Unicode for hiding malicious Python (opens in new tab) code turn out to be a pattern, it’d turn out to be trigger for concern.

“However, whomever this writer copied this obfuscated code from is intelligent sufficient to know how one can use the internals of the Python interpreter to generate a novel sort of obfuscated code, a sort that’s considerably readable with out divulging an excessive amount of of precisely what the code is making an attempt to steal,” concludes Phylum.

• Listed here are the very best malware removing instruments proper now

Through: BleepingComputer (opens in new tab)