New Malicious PyPI Packages Use DLL Sideloading In A Supply Chain Attack

Researchers have discovered that threat actors have been using open-source platforms and codes for several purposes, such as hosting C2 infrastructure, storing stolen data, and delivering second and third-stage downloaders or rootkit programs.

Two open-source PyPI packages were discovered to be utilized by threat actors for executing code via DLL sideloading attacks as a means of evading security monitoring tools.

The packages were identified as NP6HelperHttptest and NP6HelperHttper. 

Malicious PyPI Packages

According to the reports shared with Cyber Security News, …

attack c2 infrastructure code data dll dll sideloading hosting infrastructure malicious malicious pypi packages packages platforms pypi pypi packages researchers rootkit sideloading stage stolen supply supply chain supply chain attack third threat threat actors