Full Report
A malicious PyPI package “aiocpa,” that stole crypto wallet data via obfuscated code, has been removed after being reported by Reversing Labs researchers
Analysis Summary
# Tool/Technique: aiocpa (Malicious PyPI Package)
## Overview
The **aiocpa** package discovered on the Python Package Index (PyPI) is a malware disguised as a legitimate crypto client tool. Its primary purpose is to steal cryptocurrency wallet data and exfiltrate sensitive information to a remote Telegram bot.
## Technical Details
- Type: Malware (Supply Chain Contamination via Malicious Package)
- Platform: Python/Packages relying on PyPI dependencies (likely Linux/Windows development environments)
- Capabilities: Stealing crypto wallet tokens/data, obfuscation, communication with C2 via Telegram API.
- First Seen: Discovered November 21, 2024.
## MITRE ATT&CK Mapping
This incident primarily maps to supply chain compromise and credential access:
- **TA0001 - Initial Access**
- **T1195 - Supply Chain Compromise**
- T1195.002 - Compromise Software Supply Chain
- **TA0006 - Credential Access**
- **T1555 - Credentials from Password Stores** (Relevant if wallet secrets are treated as credentials)
- **TA0010 - Exfiltration**
- **T1041 - Exfiltration Over C2 Channel** (Using Telegram as the exfiltration channel)
## Functionality
### Core Capabilities
- **Information Theft:** Specifically targets and extracts tokens and sensitive data related to cryptocurrency clients during the initialization of the (impersonated) CryptoPay function (found within `utils/sync.py`).
- **Initial Deception:** Posed as a well-maintained crypto-pay API client with established version history (since September 2024), leveraging perceived legitimacy to gain user trust and installation.
### Advanced Features
- **Obfuscation:** Malicious code is hidden through multiple layers of **Base64 encoding** and **zlib compression** to evade static analysis and security checks.
- **Communication Channel:** Exfiltrates stolen data to a pre-determined **Telegram bot** (acting as the Command and Control server).
- **Non-Impersonation Tactic:** Avoided direct impersonation of popular packages, instead building an appearance of legitimacy for a new tool, making detection harder.
## Indicators of Compromise
*The article does not provide specific hashes, file paths, or network indicators beyond the mechanism of exfiltration.*
- File Hashes: [Not provided in the article]
- File Names: `utils/sync.py` (containing the wrapper for the malicious logic)
- Registry Keys: [Not provided in the article]
- Network Indicators: Communication established with an unknown **Telegram bot** for data exfiltration (defanged: `telegram[.]org` API endpoints likely used).
- Behavioral Indicators: Execution of CryptoPay initializers leading to data serialization (Base64/zlib) and external API calls (Telegram).
## Associated Threat Actors
- [Not explicitly named in the article, discovered by Reversing Labs]
## Detection Methods
*The article emphasizes the difficulty in detection using traditional means due to the payload being hidden within legitimate-looking structure and obfuscation.*
- Signature-based detection: Likely bypassed due to heavy obfuscation and seemingly benign package history.
- **Behavioral detection:** Highly recommended due to the suspicious activity of encoding/compressing data followed by external communication to non-standard channels (e.g., Telegram APIs).
- YARA rules: [Not provided in the article]
## Mitigation Strategies
The Reversing Labs recommendations focus on securing the software supply chain during dependency management:
- **Pin dependencies and versions:** Prevent automatic, untrusted updates to packages.
- **Use hash checks:** Verify package integrity against known good checksums before installation.
- **Perform advanced security assessments:** Utilize behavioral analysis tools on installed open-source components.
## Related Tools/Techniques
- Other PyPI/Supply Chain incidents mentioned: Zlibxjson (stealing Discord/Browser data), VMConnect.
- Related Stealers: The modus operandi (stealing crypto wallets) is similar to known infostealers like Lumma Stealer (mentioned in related news).