MALICIOUS PYPI PACKAGES DELIVER SILENTSYNC RAT

Summary from the TLDR InfoSec newsletter

Threat actors uploaded two malicious packages, sisaws and secmeasure, to PyPI that typosquat legitimate libraries and deliver the SilentSync RAT. This malware is downloaded from Pastebin and maintains persistence through registry keys, crontab modifications, or launch agents, depending on the operating system. SilentSync communicates with a hardcoded C2 server at 200.58.107[.]25 over HTTP and steals browser data, including credentials, history, autofill data, and cookies from Chrome, Brave, Edge, and Firefox while also enabling remote command execution and file exfiltration.