https://x.com/jfrogsecurity/status/1973081889977114815 reports:
Our security team uncovered a malicious PyPI package called SoopSocks, which disguises itself as a SOCKS5 proxy but behaves like a backdoor. Our research revealed that it installs persistence via Windows services and scheduled tasks, modifies firewall rules, silently executes PowerShell with UAC bypass, and exfiltrates host and network data to a hardcoded Discord webhook every 30 seconds. It evolved from a Python module to a Go executable with hidden deployment scripts, enabling attackers to proxy traffic, anonymize connections, and perform stealthy reconnaissance. SoopSocks was removed from PyPI on September 29 after our disclosure. Read our full technical deep dive, including dynamic analysis, IOCs, and remediation steps here: https://research.jfrog.com/post/check-your-socks-a-deep-dive-into-soopsocks-pypi/ -- -Alan Coopersmith- [email protected] Oracle Solaris Engineering - https://blogs.oracle.com/solaris
