Cybersecurity researchers have uncovered two dangerous packages in the Python Package Index (PyPI) that secretly install the SilentSync remote access trojan on Windows systems.
## The Threat Discovery
Security experts from Zscaler ThreatLabz identified two malicious packages uploaded by a user named “CondeTGAPIS”:
– **sisaws** (201 downloads)
– **secmeasure** (627 downloads)
Both packages have since been removed from PyPI, but they demonstrate the growing threat of supply chain attacks targeting software repositories.
## How SilentSync Works
The SilentSync trojan is a sophisticated malware capable of:
– **Remote command execution** on infected systems
– **File theft and exfiltration** of sensitive data
– **Screen capturing** for surveillance
– **Browser data extraction** from Chrome, Brave, Edge, and Firefox, including passwords, browsing history, and cookies
## Attack Methods
### Sisaws Package
This malicious package impersonates Argentina’s legitimate health system library (SISA). When developers import the package and call the “gen_token()” function, it:
1. Decodes a hidden curl command
2. Downloads additional malware from PasteBin
3. Executes the payload as “helper.py”
### Secmeasure Package
Disguised as a security tool for “cleaning strings and applying security measures,” this package contains embedded functionality to deploy the SilentSync trojan.
## Cross-Platform Capabilities
While primarily targeting Windows systems, SilentSync includes features for multiple operating systems:
– **Windows**: Modifies system registry
– **Linux**: Alters crontab files for persistence
– **macOS**: Registers LaunchAgents
## Communication Infrastructure
The malware communicates with a command-and-control server (200.58.107[.]25) through four endpoints:
– `/checkin` – Verifies connectivity
– `/comando` – Receives execution commands
– `/respuesta` – Sends status updates
– `/archivo` – Transmits stolen data
## Key Takeaways
This discovery highlights the increasing risk of supply chain attacks through typosquatting and package impersonation. Organizations and developers must implement stronger security measures when using third-party packages, including thorough vetting and monitoring of dependencies.
The incident underscores the critical need for enhanced security awareness in software development environments, where malicious actors exploit trust in public repositories to distribute dangerous malware.