Cybersecurity experts have identified a new attack vector where threat actors are deploying malicious Python packages that exploit social media platforms’ internal APIs to validate stolen credentials.
These packages, published on the Python Package Index (PyPI), specifically target TikTok and Instagram, enabling attackers to verify whether stolen email addresses correspond to actual accounts on these platforms.
The malicious packages, identified as checker-SaGaF, steinlurks, and sinnercore, operate by programmatically interfacing with private API endpoints that were designed for legitimate password recovery and account management functions.
By abusing these endpoints, attackers can systematically process lists of potentially compromised email addresses, confirming which ones are associated with active accounts.
This validation step is critical in attack chains as it allows threat actors to focus their efforts exclusively on confirmed accounts, minimizing detection risks while maximizing success rates.
“Checkers are an integral first step in many exploit chains,” explains the analysis report.
“Once threat actors have this information, just from an email address, they can threaten to dox or spam, conduct fake report attacks to get accounts suspended, or solely confirm target accounts before launching credential stuffing or password spraying exploits.”
Socket.dev researchers noted that these malicious packages implement sophisticated techniques to evade detection systems.
The packages appear legitimate at first glance but contain code that interfaces directly with TikTok and Instagram’s internal API endpoints in ways that weren’t intended for public use.
Methods Employed
The most sophisticated of these packages, steinlurks, employs five different methods to check Instagram accounts, randomly cycling between them to avoid triggering anti-abuse measures.
The package’s code reveals a deliberate approach to evading detection:-
def generate_user_agent():
"""Generate a random user agent string."""
ii = ["165.1.0.29.119", "166.0.0.30.120", "167.0.0.31.121", "168.0.0.32.122"]
# Additional code omitted for brevity
user_agent = (
f"Instagram {random.choice(ii)} Android "
f"({sos}; {vlo}; {lop}; {ki}; {mo}; "
f"{random.choice(arm)}; {random.choice(dp)}; "
f"{random.choice(lan)}; {random.choice(cc)})"
)
return user_agentThis function generates randomized mobile User-Agent strings designed to mimic the Instagram Android app. By dynamically creating different identifiers for each request, the malware significantly reduces its detectability through traditional pattern matching.
Furthermore, the packages distribute their API calls across multiple endpoints. When one function targets the Instagram password recovery API at i.instagram.com/api/v1/accounts/send_recovery_flow_email/, another uses the account lookup endpoint at i.instagram.com/api/v1/users/lookup/.
This diversification ensures that if one pathway is blocked, others remain available, demonstrating the attacker’s thorough understanding of both platform architecture and security countermeasures.
The discovery highlights the growing sophistication of supply chain attacks targeting developer ecosystems, with attackers exploiting trusted repositories to distribute tools that convert stolen data into actionable intelligence for further exploitation.
Equip your SOC team with deep threat analysis for faster response -> Get Extra 𝗦𝗮𝗻𝗱𝗯𝗼𝘅 𝗹𝗶𝗰𝗲𝗻𝘀𝗲𝘀 for Free
