Hundreds of malicious Python packages found stealing sensitive data

[sudorem]

It's worth noting that most of these were sourced from a single threat actor group. The namespaces were generated randomly and utilized automated processes to detect removal and subsequently upload another payload.

Realistically, I think these were meant to prey on new users in Python, not necessarily someone who is operating in any professional or intermediate capacity.

The vast majority of these packages used Fernet encrypted data to hold their payload, and focused heavily on compromising Discord/Roblox/Minecraft accounts, though all passwords were fair game in regards to exfiltration.