New Campaign Attacking PyPI Users to Steal Sensitive Data Including Cloud Tokens

Security researchers have uncovered a sophisticated malware campaign targeting users of the Python Package Index (PyPI), Python’s official third-party software repository. This latest attack vector involves several malicious packages disguised as time-related utilities, which are actually designed to steal sensitive information including cloud access tokens, API keys, and other credentials. According to Reversing Labs post […] The post New Campaign Attacking PyPI Users to Steal Sensitive Data Including Cloud Tokens appeared first on Cyber Security News.

Mar 14, 2025 - 09:40

New Campaign Attacking PyPI Users to Steal Sensitive Data Including Cloud Tokens

Security researchers have uncovered a sophisticated malware campaign targeting users of the Python Package Index (PyPI), Python’s official third-party software repository.

This latest attack vector involves several malicious packages disguised as time-related utilities, which are actually designed to steal sensitive information including cloud access tokens, API keys, and other credentials.

According to Reversing Labs post shared on X, the campaign, identified in early March 2025, involves multiple packages with names such as “time-utils”, “timeformat”, and “execution-time-async” that mimic legitimate time measurement libraries.

These packages employ a technique known as combosquatting, where attackers add plausible-sounding words to existing package names to deceive developers.