Hackers Backdoor Telnyx Python SDK on PyPI to Steal Credentials Across Windows, macOS, and Linux

Hackers Backdoor Telnyx Python SDK on PyPI to Steal Credentials Across Windows, macOS, and Linux

A recent security incident has highlighted a sophisticated attack where hackers backdoored the Telnyx Python SDK (software development kit) available on the Python Package Index (PyPI). This malicious activity aimed at stealing credentials across various operating systems, including Windows, macOS, and Linux.

Immediate Action Required

Organizations using the Telnyx Python SDK should immediately take the following steps:

• Uninstall the compromised package.
• Update to a secure version if available or use an alternative library.
• Conduct thorough scans for any malicious WAV files and executables that may have been downloaded as part of this attack.

Technical Details

The attackers employed several sophisticated techniques to evade detection:

1. Malicious WAV Files: The backdoored SDK downloads and executes malicious WAV files from unexpected IP addresses over port 8080.
2. HTTP Headers: Outbound HTTP requests carrying the header X-Filename: tpcp.tar.gz are indicative of this attack vector.
3. Persistence Mechanism: On Windows, a disguised executable named msbuild.exe is installed into the Startup folder

Read the full article at Cyber Security News

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.