Six Malicious Python Packages in the PyPI Targeting Windows Users
Summary: In March 2023, Unit 42 researchers found six malicious packages on the Python Package Index that targeted Windows users to steal application credentials, personal data and cryptocurrency wallet information. Each package was uploaded by a newly created single-use account with "1337" as a username suffix, carried a link to a remote URL, and reached hundreds of downloads before PyPI removed the packages and accounts after the researchers reported the abuse.
What you should know: The attack code ran from setup.py during installation, so the compromise happened before a developer ever imported the package, and the second stage was a configured version of W4SP Stealer 1.1.6 that decrypted stored browser credentials and sent them to a Discord webhook. The researchers assessed this as a copycat of W4SP rather than an organized campaign, which means the barrier to entry is low enough that someone working from published technical reports reached hundreds of downloads.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026