Malicious Python Packages Attacking Popular Cryptocurrency Library To Steal Sensitive Data

Cybersecurity experts have identified a new threat targeting cryptocurrency developers and users.

Two malicious Python packages have been discovered on the Python Package Index (PyPI) specifically designed to compromise systems using the popular bitcoinlib library.

These packages, identified as bitcoinlibdbfix and bitcoinlib-dev, masquerade as legitimate fixes for the cryptocurrency library while containing code designed to exfiltrate sensitive database files containing valuable crypto wallet information.

The bitcoinlib library serves as a critical tool for developers building cryptocurrency applications, providing essential functionality for creating and managing crypto wallets, interacting with blockchain networks, and executing Bitcoin scripts.

This makes it an especially valuable target for attackers seeking to compromise cryptocurrency assets or gain access to sensitive blockchain data.

ReversingLabs researchers identified these malicious packages through their Spectra platform, which employs advanced machine learning algorithms to detect novel malware by analyzing behavioral patterns.

According to their analysis, both packages were designed as part of a targeted supply chain attack, continuing a troubling trend in cryptocurrency-related software compromises that saw nearly two dozen similar campaigns throughout 2024.

The attackers employed classic social engineering techniques, presenting their malicious packages as solutions to a purported database issue in bitcoinlib.

One package claimed to fix a “ValueError: Old database version found (0.5 version database automatically” error, luring developers seeking quick solutions to implement the compromised code.

Once installed, the malicious packages execute a sophisticated attack by targeting the legitimate command-line interface tool.

Infection Mechanism Analysis

The core of the attack involves overwriting the legitimate “clw” command-line tool with malicious code.

The packages contain functionality to first remove any existing clw command using code like:-

def remove_existing_clw():
    """Remove existing clw command from system if it exists"""
    try:
        clw_path = check_output(['which', 'clw'], stderr=sys.stderr).decode().strip()
        if clw_path:
            os.remove(clw_path)
    except CalledProcessError:
        pass

After removing the legitimate tool, the malware creates a symlink to its own executable, enabling it to intercept commands meant for cryptocoin wallet management.

This provides the attackers with a persistent mechanism to harvest sensitive database files containing private keys and wallet information, which are then exfiltrated to attacker-controlled servers.

Investigate Real-World Malicious Links & Phishing Attacks With Threat Intelligence Lookup - Try 50 Request for Free