Loading story…
A malicious package named soopsocks was discovered on the Python Package Index (PyPI), masquerading as a legitimate tool for creating a SOCKS5 proxy service but actually delivering a sophisticated backdoor to Windows systems. The package was uploaded by a user with the handle "soodalpie" on September 26, 2025, and managed to attract 2,653 downloads before it was removed from the repository. Security researchers from JFrog analyzed the package and found that, in addition to its advertised SOCKS5 proxy functionality, it included a compiled Go executable named "_AUTORUN.EXE". This executable was capable of running PowerShell scripts, modifying firewall rules, and relaunching itself with elevated privileges to ensure persistence and deeper system access. The package also performed system and network reconnaissance, collecting details such as Internet Explorer security settings and the Windows installation date, which it exfiltrated to a hard-coded Discord webhook for attacker control.
The infection chain involved a Visual Basic Script ("_AUTORUN.VBS") that, in versions 0.2.5 and 0.2.6, executed a PowerShell script to download a ZIP file containing a legitimate Python binary from an external domain. This process generated a batch script to install and run the soopsocks package, which then elevated its privileges, configured firewall rules to allow UDP and TCP traffic on port 1080, and installed itself as a persistent service. The malware maintained communication with the attacker's Discord webhook, allowing for remote command and control. It also set up a scheduled task to ensure it would automatically start upon system reboot, further entrenching itself on infected machines.
The backdoor capabilities of soopsocks enabled attackers to execute arbitrary payloads, potentially granting them root or administrative access to compromised systems. The package's stealthy installation and persistence mechanisms made detection and removal more challenging for victims. The use of a popular open-source repository like PyPI for distribution increased the risk of widespread infection, as unsuspecting developers could easily incorporate the malicious package into their projects. Security researchers emphasized the importance of scrutinizing third-party packages and monitoring for unusual network activity, especially communications with known malicious endpoints such as Discord webhooks. The incident highlights ongoing threats to the software supply chain, where attackers leverage trusted platforms to distribute malware. The rapid takedown of soopsocks by PyPI administrators limited further spread, but the incident underscores the need for enhanced vetting and monitoring of open-source repositories. Organizations are advised to review their dependency lists and audit systems for signs of compromise related to the soopsocks package. The attack demonstrates the evolving tactics of threat actors in targeting developer ecosystems and exploiting automated installation processes. Defensive measures should include restricting administrative privileges, monitoring scheduled tasks, and implementing network controls to detect unauthorized outbound communications. The soopsocks incident serves as a reminder of the critical importance of supply chain security in modern software development environments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Researchers publicly reported that soopsocks was a malicious package masquerading as a SOCKS5 proxy, and PyPI removed it from the repository. Reporting highlighted that the malware could grant elevated or root-level access and fetch additional payloads from attacker-controlled infrastructure.
Before it was taken down, the malicious soopsocks package was downloaded 2,653 times, exposing or infecting thousands of systems. Its payload chain used VBScript or a Go-based executable to launch PowerShell, alter firewall rules, open port 1080, install itself as a service, and exfiltrate host data to a Discord webhook.
A newly created account named "soodalpie" uploaded the package "soopsocks" to PyPI, advertising it as a SOCKS5 proxy tool. The package actually contained a Windows-focused backdoor and installer chain for persistence, privilege escalation, reconnaissance, and data exfiltration.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported multiple **software supply-chain** threats in public package registries where attacker-controlled libraries masquerade as legitimate utilities but install **Windows infostealers**. On NPM, a package named **`duer-js`** (publisher `luizaearlyx`) posed as a console visibility tool and delivered a multi-stage stealer self-identified as **Bada Stealer**; analysis attributed to **JFrog Security Research** described heavy obfuscation, persistence that can survive simple uninstall attempts, and follow-on payload delivery targeting **Discord** by hijacking the desktop client’s startup/injection path to continuously steal data when Discord runs. Separately, Safety’s research team documented **“ExtraZip”**, a campaign of **14 trojanized PyPI packages** impersonating ZIP utilities or mail-sending libraries that deploy a staged infostealer focused on **Telegram Desktop session files**, exfiltrating them via an attacker-controlled **Telegram bot**. The report described **32 layers of obfuscation** and provided an inventory of package names (e.g., `extrazip`, `minizip`, `ziphash`, and multiple `smt*lib` lookalikes) and a timeline of publishing activity across late 2025 through early 2026, indicating sustained, iterative attempts to seed malicious dependencies into developer environments.
Jun 29, 2026
Cybersecurity researchers have uncovered a coordinated campaign in which malicious packages distributed through popular open-source repositories—npm, PyPI, and RubyGems—are being used to exfiltrate sensitive developer data using Discord webhooks as a command-and-control (C2) channel. Attackers have published several packages, such as mysql-dumpdiscord and nodejs.discord on npm, as well as malinssx, malicus, and maliinn on PyPI, and sqlcommenter_rails on RubyGems, which are designed to steal configuration files, environment variables, and host information from developer systems. These packages leverage Discord webhooks, which allow data to be sent directly to attacker-controlled Discord channels without requiring authentication or bot users, making detection and mitigation more challenging. The use of Discord webhooks is particularly insidious because webhook URLs are write-only, preventing defenders from easily auditing what data has been exfiltrated. In some cases, the malicious code is triggered during package installation, such as with 'pip install' commands, enabling the theft of sensitive information before runtime monitoring can detect the activity. The stolen data includes critical files like config.json, .env, ayarlar.js, ayarlar.json, and even system files such as '/etc/passwd' and '/etc/resolv.conf', which may contain credentials, API keys, and other secrets. By abusing Discord’s infrastructure, attackers avoid the costs and risks associated with maintaining their own C2 servers, and their traffic often blends in with legitimate communications, bypassing many firewall and monitoring solutions. The campaign highlights the ongoing risks associated with software supply chain attacks, where threat actors target developers and CI/CD environments by injecting malicious code into widely used open-source packages. Security experts warn that such attacks can have far-reaching consequences, as compromised developer machines and build systems may inadvertently propagate stolen secrets or further malicious code into downstream applications. The discovery underscores the importance of rigorous package vetting, monitoring for suspicious network activity, and the use of security tools that can detect anomalous behavior during package installation. Researchers emphasize that the abuse of Discord webhooks for C2 is a growing trend, as it offers attackers a free, scalable, and stealthy method for data exfiltration. The incident serves as a reminder for organizations to review their dependency management practices and to educate developers about the risks of installing untrusted packages. The affected repositories have been notified, and some of the malicious packages have been removed, but the ease of publishing new packages means the threat remains ongoing. This campaign demonstrates the evolving tactics of threat actors in targeting the software supply chain and the need for continuous vigilance in the open-source ecosystem. Organizations are advised to implement automated scanning of dependencies and to restrict outbound network connections from build environments where possible. The use of Discord as a C2 channel is expected to persist, given its accessibility and the difficulty of monitoring webhook-based exfiltration. Security teams should update detection rules to flag unexpected communications with Discord domains, especially from development and CI/CD systems. The incident also highlights the broader challenge of securing open-source software, where trust in package maintainers and repositories is critical but increasingly under attack.
Jun 29, 2026
Researchers detailed **VIPERTUNNEL**, a Python-based backdoor delivered as an obfuscated file masquerading as a DLL and loaded through a malicious `sitecustomize.py`, with persistence established via a scheduled task. After multiple layers of encoding, compression, and decryption are removed, the payload resolves into a SOCKS5 proxy backdoor that connects outbound to a hardcoded command-and-control server over port `443`, authenticates with embedded credentials, and relays traffic into the victim's local network through threaded proxy components. Analysis of samples from late 2023 through late 2025 shows the malware evolving from unstable development builds into a more mature, stealth-focused variant. Investigators linked the infrastructure to **Pyramid C2** servers that frequently expose an HTTP `401` response with a distinctive `Basic realm="Proxy"` header and often use ports `22`, `443`, and sometimes `8000`; the activity has also been associated in reporting with **UNC2165/EvilCorp** and shares obfuscation traits with the **ShadowCoil** credential stealer. Defenders were advised to watch for `pythonw.exe` launched without arguments, suspicious numeric scheduled tasks, unexpected `sitecustomize.py` files, and unusual outbound proxy traffic patterns.
Jul 14, 2026