US EditionGmail servers hijacked by malicious PyPI packages to spread havoc - here's how to stay safe
- Cybersecurity researchers Socket discovered seven malicious PyPI packages abusing Gmail servers to steal data and relay commands in 2025.
- These packages, some active for over four years with more than 55,000 downloads, mainly mimic the legitimate Coffin package to evade suspicion.
- Once installed, the malware uses hardcoded Gmail credentials to create communication tunnels via WebSockets, bypassing firewalls and enabling remote control.
- One command-and-control email address included 'blockchain' and 'bitcoin', indicating attackers focused primarily on crypto theft, while Socket urged users to verify package authenticity.
- Socket advised immediate removal of these packages, rotating credentials, limiting key access, and using isolated environments to mitigate ongoing security risks.
13 Articles
13 Articles
The Peterborough Examiner
Billions of Gmail users at risk with new phishing scam — here’s how to spot it
First highlighted on X by Nick Johnson, founder and chief developer of Ethereum Name Services (ENS), the phishing attack targets Gmail users with a convincing phishing site that uses a google.com subdomain and a message that seems to come from a legitimate no-reply@google.com address.
Gmail servers hijacked by malicious PyPI packages to spread havoc - here's how to stay safe - WorldNL Magazine
(Image credit: Shutterstock / Trismegist san) Socket found seven malicious packages on PyPIThe packages were abusing Gmail and WebSocketThey were removed from the platformSeveral malicious PyPI packages were recently observed abusing Gmail to exfiltrate stolen sensitive data and communicate with their operators.Cybersecurity researchers Socket, who found the packages, reported them to the Python repository and thus helped get them removed from …
Gmail users at risk with 'replay attack' scam in Ontario #Canada #CDN #CDNNews #Ontario
A new phishing scam is reportedly targeting Gmail users with emails that appear to come from a legitimate Google address, claiming a subpoena has been issued and directing recipients to fake sign-in pages. The scam, known as a “replay attack,” is an email designed to mimic the appearance of a real security alert. It claims that a legal request has been made for the user’s account data, includes a reference number and account ID, and directs the …
Coverage Details
Bias Distribution
- 89% of the sources lean Left
To view factuality data please Upgrade to Premium
Ownership
To view ownership data please Upgrade to Vantage
