Criminals have been discovered impersonating a well known cybersecurity agency in an try and steal knowledge from software program builders, researchers have discovered.

Researchers from ReversingLabs lately found a malicious Python (opens in new tab) package deal on PyPI referred to as “SentinelOne”. Named after a identified cybersecurity firm from the USA, the package deal pretends to be a respectable SDK shopper permitting easy accessibility to the SentinelOne API from inside a separate undertaking. 

Nonetheless, the package deal additionally carries “api.py” recordsdata which maintain the malicious code, and permit the menace actors to exfiltrate delicate knowledge from the builders to a third-party IP deal with (54.254.189.27).

Going after auth tokens and API keys

The info being stolen contains Bash and Zsh histories, SSH keys, .gitconfig recordsdata, hosts recordsdata, AWS configuration information, Kube configuration information, and others. As per the publication, these folders normally retailer auth tokens, secrets and techniques, and API keys, which might allow menace actors additional entry to focus on cloud companies and server endpoints. 

The worst half is that the package deal does provide the performance the builders anticipate. In actuality, it is a hijacked package deal, that means unsuspecting builders may find yourself utilizing it and changing into victims in ignorance. The excellent news is that ReversingLabs confirmed the malicious intent of the package deal, and after reporting it to each SentinelOne and PyPI, had it faraway from the repository.

Within the days and weeks main as much as the removing, the malicious actors had been fairly energetic. The package deal was first uploaded to PyPI on December 11, and has been up to date 20 occasions in lower than 10 days. 

One of many points that had been mounted with an replace was the shortcoming to exfiltrate knowledge from Linux programs, the researchers discovered.

It’s tough to say if anybody fell for the rip-off, the researchers concluded, as there is no such thing as a proof the package deal acquired utilized in an precise assault. Nonetheless, all of the revealed variations had been downloaded greater than 1,000 occasions. 

• Try the perfect firewalls (opens in new tab) round

By way of: BleepingComputer (opens in new tab)