Poisoned Pipeline / Incidents / AS108
JuiceStealer PyPI phishing and typosquats
Checkmarx documented the first known phishing campaign against PyPI
maintainers: fake “validate your PyPI credentials” mail to a lookalike
login page. At least two legitimate packages were then published with
JuiceStealer (exotel 0.1.6; spam 2.0.2 / 4.0.2), stealing crypto-wallet
material and later Chrome passwords. The same malware was also pushed
through hundreds of typosquat names. SentinelOne later tied the cluster
to JuiceLedger activity dating to late 2021.
Mapped techniques
- T0113 Compromised user account
- T0109 Publish malicious artifact
- T0129 Typosquatting
- T0111 Malicious code contribution to an open-source repository
- T0159 Malicious artifact execution
- T0139 Resource hijacking
- T0201 Customers compromised
supply-chain PyPI maintainers
Phishing to a fake PyPI login stole maintainer credentials.
Poisoned versions of exotel and spam plus hundreds of typosquats.
Parallel upload of lookalike package names carrying JuiceStealer.
Malicious code landed in already-trusted package names.
post-supply-chain PyPI consumers
Installing the poisoned versions ran JuiceStealer.
Crypto-wallet theft, later expanded to Chrome password theft.
Hundreds of thousands of historical downloads on the hijacked names.