malware in SoopSocks package on PyPi

[Alan Coopersmith <alan.coopersmith () oracle com>]

https://x.com/jfrogsecurity/status/1973081889977114815 reports:

Our security team uncovered a malicious PyPI package called SoopSocks,
which disguises itself as a SOCKS5 proxy but behaves like a backdoor.

Our research revealed that it installs persistence via Windows services
and scheduled tasks, modifies firewall rules, silently executes PowerShell
with UAC bypass, and exfiltrates host and network data to a hardcoded Discord
webhook every 30 seconds. It evolved from a Python module to a Go executable
with hidden deployment scripts, enabling attackers to proxy traffic, anonymize
connections, and perform stealthy reconnaissance.

SoopSocks was removed from PyPI on September 29 after our disclosure.

Read our full technical deep dive, including dynamic analysis, IOCs,
and remediation steps here:
https://research.jfrog.com/post/check-your-socks-a-deep-dive-into-soopsocks-pypi/

--
        -Alan Coopersmith-                 alan.coopersmith () oracle com
         Oracle Solaris Engineering - https://blogs.oracle.com/solaris