Ankura CTIX FLASH Update - November 12, 2024

Malware Activity

Malicious "Fabrice" PyPI Package with 37,000 Downloads Steals AWS Keys

A malicious Python package named "fabrice" has been discovered by security researchers in the Python Package Index (PyPI). Fabrice has been available for download since 2021 and is likely a typosquat of the very popular and legitimate SSH remote server management package "fabric". It is possible that fabrice was not flagged by the community earlier because advanced scanning tools were available only after its initial submission to PyPI. The malicious package had been downloaded over 37,000 times, and contains code scripted to steal AWS credentials using boto3, the official Python SDK for AWS. Once a boto3 session is initialized, the malicious package collects the AWS credentials associated with the session and exfiltrates the data to a VPN server. Fabrice can operate on both Windows and Linux systems. On Linux systems, it sets up a hidden directory at '~/.local/bin/vscode' to