Malware - Backdoored Telnyx PyPI Package Distributes Threat
Basically, hackers hid malware in a popular coding package to steal sensitive information.
A backdoored Telnyx package on PyPI has been found to deliver malware hidden in WAV files. Developers must act fast to secure their systems and protect sensitive data. This incident highlights the ongoing risks associated with supply-chain attacks.
What Happened
Today, hackers from TeamPCP compromised the Telnyx package on the Python Package Index (PyPI). They uploaded malicious versions of the package that deliver credential-stealing malware hidden inside WAV audio files. This supply-chain attack was detected by security firms like Aikido, Socket, and Endor Labs. The breach is attributed to TeamPCP due to their distinct exfiltration patterns and RSA keys used in previous attacks.
The malicious versions, Telnyx 4.87.1 and 4.87.2, were published earlier today. The first version contained a non-functioning payload, but within an hour, the threat actor corrected the issue with a working version. This rapid response highlights the sophistication of the attackers and their intent to exploit vulnerabilities quickly.
Who's Being Targeted
The Telnyx SDK is widely used by developers to integrate communication services like VoIP and messaging into their applications. With over 740,000 downloads per month, the potential impact of this attack is significant. Both Linux and macOS users are at risk, as the malware targets their systems to steal sensitive information such as SSH keys, cloud tokens, and cryptocurrency wallets.
Windows users are also affected, with the malware designed to run persistently by placing itself in the startup folder. This means that once infected, the malware can execute every time the system boots up, increasing the risk of data exfiltration.
Signs of Infection
The malicious code is embedded in the telnyx/_client.py file, which activates automatically upon import. On Linux and macOS, the malware downloads a second-stage payload disguised as a WAV file. This file, named ringtone.wav, is processed using steganography, allowing the malware to extract and execute its payload without altering the audio.
For Windows users, a different WAV file (hangup.wav) is used to deploy an executable named msbuild.exe. This executable is strategically placed in the Startup folder to ensure it runs automatically, further complicating detection and removal efforts.
How to Protect Yourself
Developers who have imported the malicious versions of the Telnyx package should treat their systems as fully compromised. The best course of action is to roll back to the clean variant, Telnyx version 4.87.0, which contains no malicious alterations. Additionally, it is crucial to rotate all secrets and sensitive data that may have been exposed during the attack.
Security researchers recommend immediate action to mitigate risks. If you suspect your environment has been compromised, conduct a thorough security audit and remove any unauthorized packages. Staying vigilant and informed is key to preventing future attacks like this one.
BleepingComputer