7 Malicious PyPI Packages Abuse Gmail’s SMTP Protocol to Execute Malicious Commands

-



A highly advanced software supply chain attack has been uncovered, which exploits Python Package Index (PyPI) repositories to spread malware. This attack uses Google’s SMTP infrastructure as a covert command-and-control (C2) channel.

The campaign distributed seven malicious packages—Coffin-Codes-Pro, Coffin-Codes-NET2, Coffin-Codes-NET, Coffin-Codes-2022, Coffin2022, Coffin-Grave, and cfc-bsb—which collectively exceeded 55,000 downloads before being taken down.

Advanced Communication Method

These malicious packages establish an SMTP connection to Gmail’s servers using embedded credentials. Through this, a two-way communication tunnel is formed, allowing attackers to run remote commands and extract data from compromised systems.

This method is particularly stealthy, as SMTP traffic typically bypasses firewall and endpoint defenses due to its appearance as normal outbound email communication.

The Coffin-Codes-Pro package exemplifies this attack.



Once the initial SMTP connection is made, the malware initiates a WebSocket connection, which acts as the primary command-and-control channel.


Long-Term Development

Based on PyPI metadata, this attack has been in development for over three years. The earliest known package, cfc-bsb, was published in March 2021. Although it lacks email-based exfiltration, it demonstrates suspicious WebSocket tunneling, resembling tools like Ngrok.

Subsequent versions improve the technique, consistently using Gmail’s SMTP port 465, while changing only the login credentials. All versions communicate with a fixed email address: blockchain.bitcoins2020@gmail.com.

Threat Capabilities

These malicious packages could allow attackers to:

  • Access restricted dashboards, APIs, and admin interfaces

  • Upload/download files and execute shell commands

  • Capture credentials and other sensitive information

  • Maintain persistent access to the victim's environment

A report by Socket shared with Cyber Security News notes that such tactics were previously used to steal Solana private keys, indicating that cryptocurrency theft may be a core objective, supported by the use of “blockchain” in communication identifiers.

Security Recommendations

Experts advise organizations to:

  • Monitor for unexpected SMTP traffic, particularly outbound connections

  • Validate package authenticity via download trends and publisher reputation

  • Perform regular dependency and supply chain audits

  • Apply strict access controls to critical internal systems

  • Test third-party code in isolated environments

These findings reinforce a broader pattern of supply chain attacks on public repositories. To mitigate such risks, tools like the Socket GitHub app, CLI, and browser extension can help identify malicious or typosquatted packages before they are integrated into projects.

Though the malicious packages have now been removed from PyPI, the underlying techniques represent a continuously evolving threat. Security teams are urged to monitor for similar activities, especially those aligning with MITRE ATT&CK technique T1102.002 (Web Service: Bidirectional Communication).

REF:https://cybersecuritynews.com/gmails-smtp-protocol-abused/

Comments

Post a Comment

Popular posts from this blog

CISA and ENISA enhance their Cooperation

-
Image
  The European Union Agency for Cybersecurity (ENISA) has signed a Working Arrangement with the Cybersecurity and Infrastructure Security Agency (CISA) of the US, in the areas of capacity-building, best practices exchange and boosting situational awareness. Geopolitics have shaped the cyber threat landscape, bringing like-minded partners closer together in the wake of common cyber challenges and advances in digital technologies. Today at the EU-US Cyber Dialogue, ENISA and CISA announced the signing of their Working Arrangement as an important milestone in the overall cooperation between the United States and the European Union in the field of cybersecurity, also following the Joint Statement of European Commissioner Thierry Breton and U.S. Secretary for Homeland Security Alejandro Mayorkas of January 2023. ENISA’s International Strategy directs the Agency to be selective in engaging with international partners and to limit its overall approach in international cooperation to those...
Read more

Critical Vulnerability in Veeam Backup & Replication Exposes Enterprises to Remote Code Execution

-
Image
Critical Vulnerability in Veeam Backup & Replication Exposes Enterprises to Remote Code Execution By : Rei Ibraima A newly discovered critical vulnerability in Veeam’s Backup & Replication software, designated as CVE-2025-23120, poses a significant security risk to enterprise environments. The flaw allows authenticated domain users to execute arbitrary code remotely, potentially leading to full compromise of backup infrastructures. About CVE-2025-23120 The vulnerability arises from an insecure deserialization issue within Veeam Backup & Replication components—particularly in the .NET classes Veeam.Backup.EsxManager.xmlFrameworkDs and Veeam.Backup.Core.BackupSummary. Improper input validation in these components allows attackers to inject malicious serialized objects that are executed on the server side, resulting in Remote Code Execution (RCE). This issue affects systems where Veeam Backup & Replication is deployed in a domain-joined configuration, which—while common—is...
Read more

SuperCard X Android Malware Enables Contactless ATM and PoS Fraud via NFC Relay Attacks

-
Image
  A new Android malware-as-a-service (MaaS) platform named  SuperCard X   can facilitate near-field communication (NFC ) relay attacks, enabling cybercriminals to conduct fraudulent cashouts. The active campaign is targeting customers of banking institutions and card issuers in Italy with an aim to compromise payment card data, fraud prevention firm Cleafy said in an analysis. There is evidence to suggest that the service is promoted on Telegram channels. SuperCard X "employs a multi-stage approach combining social engineering (via smishing and phone calls), malicious application installation, and NFC data interception for highly effective fraud," security researchers Federico Valentini‍, Alessandro Strino, and Michele Roviello said. The new Android malware, the work of a Chinese-speaking threat actor, has been observed being propagated via three different bogus apps, duping victims into installing them via social engineering techniques like deceptive SMS or WhatsApp...
Read more