Cybersecurity researchers from Phylum have found a new form of malware in a PyPI package that was using Unicode to hide. Unicode is a global encoding standard used for different languages and scripts, covering more than 100,000 characters, whose goal is to simplify and streamline how characters are viewed in electronic and digital devices. With Unicode, every letter, digit, and symbol, get a unique numeric value, that stays the same, regardless of the program or platform in use. The malware is called “onyxproxy”, it is an infostealer on the hunt for developer login credentials and authentication tokens. It was available on PyPI for a week, before being shut down, and during that time, it managed to get 183 downloads, meaning that up to 183 different developers are at risk of credential and identity theft . Hiding in plain sight The malware carries a package called “setup.py” which, according to the researchers, has “thousands” of suspicious code strings which use a combination of...
