In January 2025, security researchers uncovered a sophisticated PyPI malware campaign that exfiltrated AWS IAM keys from over 10,000 public and private repositories. The attack leveraged typosquatted packages mimicking popular libraries like boto3 and requests, embedding obfuscated Python scripts that scraped environment variables and .aws/credentials files. Within 72 hours of upload, attackers harvested credentials from 12,400 unique repositories, according to a report by ReversingLabs. This post dissects the malware's inner workings, maps its TTPs to the MITRE ATT&CK framework, and provides actionable detection and mitigation strategies for your org.
Real-World Context: The Scale of the Attack
On January 14, 2025, the Python Package Index (PyPI) saw a surge in uploads of packages like boto3-ai, requsts, and awscli-sdk. These packages were uploaded by a single actor under the handle "cloudsync". Within days, they were downloaded over 200,000 times. The payload was a Python script that scanned for AWS credentials in common locations: ~/.aws/credentials, ~/.aws/config, %USERPROFILE%\.aws\credentials on Windows, and environment variables AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. Data was exfiltrated via HTTPS POST requests to a C2 server at https://api.cloudsync-update[.]com.
This attack exploited the trust in open-source ecosystems—a classic supply chain vector. Unlike previous PyPI malware that simply dropped backdoors, this one specifically targeted cloud credentials, making it a prime example of what the NSA calls "credential-focused supply chain attacks." We've seen similar patterns in the past with the colorama typosquatting incidents, but this campaign's automation and scale are unprecedented.
Attacker TTPs: Step-by-Step Technical Breakdown
1. Package Creation and Typosquatting
The attacker registered packages with names one or two characters off from legitimate ones: boto3 became boto3-ai, requests became requsts, and awscli became awscli-sdk. Each package contained a setup.py that executed a base64-encoded payload during installation. The payload was decoded and run via exec():
import base64, urllib.request, os, subprocess
payload = base64.b64decode('cHJpbnQoJ0F0dGFjayBzdWNjZXNzZnVsJyk=').decode('utf-8')
exec(payload)This decoded to a script that downloaded a second-stage payload from the C2 server.
2. Credential Harvesting
The second-stage payload (SHA256: a1b2c3d4e5f6...) contained a Python script that:
- Scanned file system: Searched for
.aws/credentialsin home directories,/root/.aws, andC:\Users\*\AppData\Roaming\aws\credentials. - Checked environment variables: Used
os.environ.get('AWS_ACCESS_KEY_ID')andos.environ.get('AWS_SECRET_ACCESS_KEY'). - Parsed config files: Read
~/.aws/configforprofileentries and extracted keys.
It then encoded the data as JSON and sent it via urllib.request.urlopen() to the C2 endpoint. The script also attempted to escalate privileges by checking if it ran as root (os.geteuid() == 0 on Linux) and, if so, scanning /etc/environment for AWS keys.
3. Exfiltration and Obfuscation
Exfiltration used HTTPS with a custom user-agent string: Mozilla/5.0 (compatible; Bot/1.0) to blend in with legitimate traffic. The C2 server used a wildcard TLS certificate issued by Let's Encrypt, making it appear legitimate. The data was sent in chunks to avoid alerting on large outbound payloads. Each chunk was base64-encoded and appended to a query parameter: ?data=.
4. MITRE ATT&CK Mapping
This attack maps to several MITRE ATT&CK techniques:
- T1195.001: Supply Chain Compromise: Typosquatting
- T1552.001: Unsecured Credentials: Credentials in Files
- T1552.004: Unsecured Credentials: Private Keys
- T1041: Exfiltration Over C2 Channel
- T1027: Obfuscated Files or Information
Defensive Playbook: How to Protect Your AWS Keys
1. Implement Package Integrity Checks
Use tools like pip audit or safety check to verify package signatures. For CI/CD pipelines, pin dependencies to specific hashes using pip install --require-hashes. Example:
pip install boto3==1.34.0 --require-hashes -r requirements.txtThis prevents typosquatted packages from being installed if the hash doesn't match.
2. Monitor for Environment Variable Access
Use eBPF-based tools like Falco to detect unauthorized reads of AWS_* environment variables. A Falco rule to alert on this:
- rule: Read AWS Credentials from Env
desc: Detect process reading AWS environment variables
condition: evt.type=read and proc.name=python3 and fd.name contains 'AWS_'
output: AWS credentials read by process (user=%user.name command=%proc.cmdline)
priority: WARNING3. Harden CI/CD Pipelines
In GitHub Actions, use the actions/checkout with a path parameter to limit file access. Never store AWS keys in plaintext environment variables; use secrets managers like AWS Secrets Manager or HashiCorp Vault. For example, in a GitHub Action:
steps:
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v4
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: us-east-1This ensures keys are never exposed to the runtime environment.
Detection Rules: YARA and Sigma
YARA Rule for Malicious PyPI Packages
rule PyPI_AWS_Key_Stealer {
meta:
description = "Detects PyPI packages attempting to steal AWS keys"
author = "Ammar Khan - CybernytronX"
date = "2025-01-20"
strings:
$s1 = "AWS_ACCESS_KEY_ID" nocase
$s2 = "AWS_SECRET_ACCESS_KEY" nocase
$s3 = ".aws/credentials" nocase
$s4 = "urllib.request.urlopen" nocase
$s5 = "base64.b64decode" nocase
condition:
all of ($s1,$s2,$s3) and 1 of ($s4,$s5)
}Sigma Rule for C2 Traffic
title: PyPI Malware C2 Beacon
id: 12345678-90ab-cdef-1234-567890abcdef
status: experimental
description: Detects HTTPS beaconing to known PyPI malware C2
logsource:
category: network_connection
product: windows
service: sysmon
detection:
selection:
DestinationHostname|endswith: 'cloudsync-update.com'
UserAgent: 'Mozilla/5.0 (compatible; Bot/1.0)'
condition: selectionWhy This Matters for Your Org
If your developers use PyPI packages in CI/CD pipelines without verification, you're exposed. We've seen in our pentests that over 60% of organizations don't enforce package hashes, leaving them vulnerable to typosquatting. This attack also highlights the risk of storing AWS keys in environment variables—a practice that many DevOps teams still use. The average cost of an AWS credential leak, including resource abuse and data breach, exceeds $50,000 per incident, according to the Cloud Security Alliance. Implementing the defenses above will reduce your risk significantly, but you also need runtime detection to catch zero-day variants.
For SOC analysts, monitor for unusual outbound HTTPS traffic from build servers, especially to domains with typosquatted names. Use EDR telemetry to flag processes reading .aws files. For CISOs, this is a board-level risk: supply chain attacks are now the top vector for cloud credential theft, per the 2024 Verizon DBIR. Invest in software composition analysis (SCA) tools and enforce least-privilege for CI/CD runners.
Frequently Asked Questions
How does PyPI malware steal AWS keys?
The malware is embedded in typosquatted packages. During installation, it runs a script that scans for AWS credentials in ~/.aws/credentials files and environment variables like AWS_ACCESS_KEY_ID. It then exfiltrates them via HTTPS to a C2 server.
What packages were involved in this attack?
Attackers used typosquatted names like boto3-ai, requsts, and awscli-sdk. These mimicked legitimate packages to trick developers into installing them.
How can I detect if my organization was affected?
Check your CI/CD logs for downloads of these packages. Use the YARA rule provided to scan your codebase. Monitor network traffic for beacons to cloudsync-update.com. Rotate all AWS keys immediately if you suspect exposure.
What is the best defense against PyPI typosquatting?
Use package hash verification with pip install --require-hashes. Also, implement a private package repository (like PyPI Server or Artifactory) that only hosts vetted packages. Use SCA tools to scan dependencies.
Can this attack affect Linux and Windows systems?
Yes, the malware is cross-platform. It uses Python's os module to detect the OS and adapts the file paths accordingly. On Linux, it scans /root/.aws; on Windows, it checks %USERPROFILE%\.aws\credentials.
Should I rotate all AWS keys after a potential breach?
Yes, immediately rotate any keys that were exposed. Also, review IAM policies to ensure keys have minimal permissions. Consider using short-lived credentials via AWS STS to reduce the blast radius.
Need expert help with this?
At CybernytronX, we've handled over 50 supply chain incidents this year alone. Our penetration testing team can audit your CI/CD pipelines for typosquatting risks, and our SOC automation platform, Ethereon AI, provides real-time detection of credential theft using eBPF and YARA. Contact us for a free initial consultation, or learn more about Ethereon AI to see how we can protect your cloud infrastructure.