[<prev] [next>] [day] [month] [year] [list]
Message-ID: <44cea7ac-ef99-49bf-8ce5-65cac0b5440b@oracle.com>
Date: Tue, 30 Sep 2025 11:09:21 -0700
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com
Subject: malware in SoopSocks package on PyPi
https://x.com/jfrogsecurity/status/1973081889977114815 reports:
Our security team uncovered a malicious PyPI package called SoopSocks,
which disguises itself as a SOCKS5 proxy but behaves like a backdoor.
Our research revealed that it installs persistence via Windows services
and scheduled tasks, modifies firewall rules, silently executes PowerShell
with UAC bypass, and exfiltrates host and network data to a hardcoded Discord
webhook every 30 seconds. It evolved from a Python module to a Go executable
with hidden deployment scripts, enabling attackers to proxy traffic, anonymize
connections, and perform stealthy reconnaissance.
SoopSocks was removed from PyPI on September 29 after our disclosure.
Read our full technical deep dive, including dynamic analysis, IOCs,
and remediation steps here:
https://research.jfrog.com/post/check-your-socks-a-deep-dive-into-soopsocks-pypi/
--
-Alan Coopersmith- alan.coopersmith@...cle.com
Oracle Solaris Engineering - https://blogs.oracle.com/solaris
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
