Instagram and TikTok accounts are being stolen using malicious PyPI packages

Date:
Tue, 20 May 2025 12:43:59 +0000

Description:
Someone's hunting for Instagram and TikTok email accounts and triggering the password reset process.

FULL STORY

Security researchers have found some of the tools cybercriminals are using to steal peoples Instagram and TikTok accounts - on PyPI.

The Python Package Index (PyPI), one of the worlds biggest repositories of Python code, is often abused to holst malicious code, or trick software developers into downloading and running tainted code in their projects.

In this case, security researchers from Socket found three packages, named checker-SaGaF, steinlurks, and sinnercore. Cumulatively, these three had
around 7,000 downloads before being pulled from the platform.

Credential stuffing and password spraying

The first two acted as email address validators, cross-referencing supplied email addresses with TikTok and Instagram APIs, to see if they are associated with accounts on the platform. While simply checking if an email address is valid doesnt seem to be particularly harmful, it is an important step in cybercriminal activity, the researchers explained.

"Once threat actors have this information, just from an email address, they
can threaten to dox or spam, conduct fake report attacks to get accounts suspended, or solely confirm target accounts before launching a credential stuffing or password spraying exploit," said Sockets Olivia Brown.

"Validated user lists are also sold on the dark web for profit. It can seem harmless to construct dictionaries of active emails, but this information enables and accelerates entire attack chains and minimizes detection by only targeting known-valid accounts."

The third package, sinnercore, triggers the forgot password flow for a
given username on Instagram.

The news comes roughly a month after researchers found two malicious packages on PyPI, posing as fixes for a popular, legitimate package. The malware was designed to steal peoples cryptocurrency, which is a popular attack vector on PyPI. In this case, the legitimate package is used in building hot wallets - software wallets for cryptocurrencies. Despite being obvious malware, the two packages still managed to rake in more than 37,000 downloads before being pulled.

Via The Hacker News

======================================================================
Link to news story: https://www.techradar.com/pro/security/instagram-and-tiktok-accounts-are-being -stolen-using-malicious-pypi-packages

$$
--- SBBSecho 3.20-Linux
* Origin: capitolcityonline.net * Telnet/SSH:2022/HTTP (1:2320/105)