Movies and TV shows have taught us to associate computer hackers with difficult tasks, detailed plots, and elaborate schemes. What security researcher Carlos Fernández and I have recently found on open-source registries tells a different story: bad actors are favoring simplicity, effectiveness, and user-centered thinking. And to take their malicious code to the next level, they’re also adding new features assisted by ChatGPT. Just like software-as-a-service ( ), part of the reason why malware-as-a-service (MaaS) offerings such as , , and have become so popular in underground markets is that they have active customer support channels and their products tend to be slick and user-friendly. Needless to say, these products are often built by professional cybercriminals. SaaS DuckLogs Redline Stealer Racoon Stealer Check these boxes, fill out this form, click this button… Here's your ready-to-use malware sample! In the less popular MaaS offerings we’ve found in the wild, such as the token grabber , there’s an attempt to incorporate human-centered design principles, but the product fails in customer support. Mostly operated and consumed by teenagers, the associated Telegram accounts are full of complaints and hostile “bro-speak” due to a broken promise of a “lifetime warranty”: Discord Z3US Even before I joined Sonatype, I was wondering . And now that I’m following a series of campaigns and bad actors from around the world, something has cleared up for me: most of the malicious packages the security research team brings to my attention are not the product of a quirky genius in a hoodie coding from a dark basement filled with monitors. Thanks to the simplistic nature of MaaS, anyone can easily create and upload samples to open-source registries with minimal setup cost and technical knowledge. what the modern face of cybercrime looks like malware Avast researchers that since the start of the ongoing Covid-19 pandemic, platforms like Discord and Telegram have become increasingly popular among the younger population. Rather than using mainstream social media, these teens create malware communities in Discord for the purpose of gaming, chatting, and socializing away from parental supervision. These communities are usually led by the most technically proficient members, who show off by taking ownership of competing servers, or even by sharing screenshots featuring information they’ve stolen from unsuspecting victims. They’re also actively seeking out other members based on their programming skills or potential to contribute to their campaigns. have observed As an unintended consequence of these activities, the resilient open-source registries we rely on are facing an overburden of resources. our security researchers confirmed as malicious a whooping 6,933 packages uploaded to the npm and PyPI registries. Last month alone We recently of a Spanish-speaking group called EsqueleSquad which has uploaded more than 5,000 packages to PyPI. The payload in these packages attempted to download a Windows Trojan from Dropbox, GitHub, and Discord by using a PowerShell command. tracked the campaign We subsequently of another group called SylexSquad, possibly from Spain, who created packages containing malware designed to exfiltrate sensitive information. In addition to advertising their products with YouTube videos and selling them on a marketplace, they have a small Discord community for recruiting new members. And they seem to have plenty of time to pollute the open-source software supply chain. investigated the activities Skidded code with a dash of AI During the first week of April, our AI system flagged a series of packages uploaded to PyPI as suspicious, later confirmed to be malicious by our security researchers. These packages had a naming pattern that consisted of the prefix “py” followed by references to antivirus software: , , , and . pydefenderultra pyjunkerpro pyanalizate pydefenderpro Carlos Fernández noticed the packages were credited to the group SylexSquad, suggesting the continuation of a campaign we had tracked before involving the packages and . After making this discovery, we started mapping their activities. reverse_shell sintaxisoyyo In a game of cat and mouse, every time we confirmed one of these packages as malicious, the PyPI team would help us take it down, and a couple of hours later, the bad actors would sneak in a similarly-named package. To give you the full picture of this campaign, let’s recap our initial findings: If developers were to install the PyPI package , would execute , a lightly obfuscated script hosted on GitHub and encoded as a series of numbers that correspond to ASCII codes. reverse_shell setup.py bypass.py After deobfuscation, it would create new registry values on Windows for persistence, and consequently, it would call another GitHub-hosted file, , an information stealer. Sensitive data such as browser information (history, cookies, passwords…), Steam accounts, Telegram accounts, credit cards, and even a screenshot of the victim’s desktop, would be uploaded using the attacker’s Discord webhook. WindowsDefender.py Fast-forward to the new packages credited to this group and we find a completely different consisting of heavily obfuscated code (AES 256 encryption) generated with , a service that promises “protection by 4 layers of algorithm”. Before Carlos rolled up his sleeves for the deobfuscation process, we could only make out two pieces of information from the ocean of camouflaged code: the service URL, and a readable message: ' ' Each word in that message was a variable used for the deobfuscation process: setup.py Pyobfuscate why, are, you, reading, this, thing, huh I won’t get into details of how Pyobfuscate works, but with patience and expertise, Carlos managed to successfully deobfuscate the code and reveal its true form. He found it intriguing that the obfuscated content was not only present in but also in the previously-readable that was grabbed initially from GitHub, and now from the service. setup.py WindowsDefender.py transfer.sh When bad actors don’t move fast enough, there’s a good chance security researchers like us —and GitHub’s rules about — will ruin their plans. Such is the case of , which was initially hosted on the GitHub repo “joeldev27” when it was used by the PyPI packages and , and rendered inactive soon after. not allowing the platform to be used as a malware CDN WindowsDefender.py pycracker pyobfpremium Since that filename was being used consistently, I did some digging and found that was hosted on a GitHub repo called . When I shared this finding with Carlos, he responded with a sense of wonder: “In the next few hours, a new package will appear on PyPI with an obfuscated . After installation, it will download from that repo you just found a heavily-obfuscated script named which will establish a persistence mechanism and download the info-stealer we investigated previously, also named .” WindowsDefender.py CosasRandoms480 setup.py WindowsDefender.py WindowsDefender.py His prediction turned into reality when the package appeared less than 30 minutes later on PyPI, effectively using “CosasRandoms480” as a malware CDN. We reported it to the PyPI team and it was taken down soon after. pyobfadvance Scientists and philosophers have wondered if . Working as a security researcher certainly feels that way. You’re stuck in a loop of researching, discovering, and reporting, and the same threats keep coming up over and over again. we live in a computer simulation Two days later, a new SylexSquad-credited package was flagged on our system: Same obfuscated . Same URL from executing the same with the same persistence mechanism code and the same execution of the info-stealer in . Everything looked the same, yet the file was and a new script was being summoned from : pydefenderpro. setup.py the same GitHub repo WindowsDefender.py WindowsDefender.py no longer obfuscated transfer.sh “It’s a RAT!” Carlos messaged me on . “And also an info-stealer–” Slack “A RAT Mutant?” I replied, referring to a trend of a type of malware that combines remote access trojans and info-stealers. we’ve been tracking in the wild “Exactly,” Carlos said. OSINT research revealed that the new RAT code was not original, but a copy of of : a copy DiscordRAT : a malicious package gets reported to the PyPI team, and the PyPy team takes it down. Rinse and repeat Of course, a new package, entered the scene soon after. What was different here is that the bad actors migrated to the service instead of GitHub to download , likely due to the “CosasRandoms480” repository being deactivated. pydefenderultra, pastebin.pl WindowsDefender.py We suspect that the readable version of made it easier to confirm that it was breaking . But why did the bad actors decide to deobfuscate the script? Was it too complicated for their simplistic process? WindowsDefender.py GitHub rules The RAT kept mutating. The menu and comments were now translated into Spanish and had additional functionalities. The cycle continued when they uploaded another package, . This time the added functionalities included a keylogger, audio recorder, exfiltration of OS data, and the ability to upload any file from the victim to the attacker's Discord channel. The comments on the code were unusually abundant, which is typically only associated with tutorial code and not a piece of malware. pyjunkerpro “Wait,” Carlos said, thinking out loud, “What if they’re using AI to create new functionalities?” Tools like and provide a good starting point for detecting AI-generated text. However, identifying AI-generated code is still challenging, as there are currently no available tools (that I know of) capable of doing it accurately. Fortunately, humans are still very good at recognizing patterns… GPTZero Copyleaks I quickly opened a ChatGPT tab, and typed a prompt in Spanish, which translated to: “Write Python code for a Discord bot that uploads audio from a remote computer using PyAudio.” The output I got was eerily similar: It seems we were tracking script kiddies who copied code from various sources and then used ChatGPT to add new capabilities. The resulting unique code gave them the confidence to advertise it on or sell it through their own marketplace. And nobody would suspect it wasn’t an original creation. YouTube This raises an intriguing question: what should we call these bad actors? AI-scripted kiddies? Prompt kiddies? I asked ChatGPT, and it said: If an individual is using ChatGPT to add new capabilities to their malware, they may be considered a more advanced type of hacker than a traditional script kiddie. It may be more accurate to refer to them as "hackers" or "AI-assisted hackers" instead. Fascinating. ChatGPT is giving them more status. OSINT with a dash of AI For the sake of experimentation, Carlos wanted to try a prompt to see if the tool would also help us gain further insight into the bad actors’ activities. “I need Python code that can use the Discord API as a bot (using a token). The script should connect to the bot and display the guild information, guild members, guild channels, and message history.” As expected, ChatGPT generated heavily commented code and clear instructions to get started: . So we copied the token that the "AI-assisted hackers" added in and pasted it into our AI-generated Python script. To use this code, replace "your_bot_token_here" with your bot token and run the Python script MicrosoftUpdate.py We ran that code… …and we were in! We gathered information about the members (MEE6, $Demon666, $̷y̷n̷t̷a̷x̷E̷r̷r̷o̷r̷, aitanaxx05 + 4 reps, Esmeralda, SylexNaranjoDomina, and AI Image Generator), channels, and message history. It turns out, they had infected a couple of users already — we identified one IP from Cuba and another one from India. And the OS information was being exfiltrated to channels named after the infected victim’s username: We discovered that we were connected to a bot called “SylexNaranjoDomina'' that had admin privileges. This could enable someone to add members, delete webhooks, or modify existing channels. Someone could easily change the guild name from “The server of Demon666” to “The server of a Script Kiddie” – a fitting description for this type of bad actor, though I believe ChatGPT may frown on that idea. Stay vigilant It's clear from this investigation that the proliferation of MaaS and the use of AI-assisted code has created new opportunities for less technically proficient bad actors. With more users taking advantage of these tools and offerings, there are even more opportunities for malicious packages to infect your build environment. As the cybersecurity landscape continues to evolve, so must our defenses. By staying informed, cautious, and protected, we can be one step ahead against the ever-changing threat of cybercrime.
