Threat hunters have uncovered a concerning discovery on the Python Package Index (PyPI) repository: a set of seven packages designed to pilfer BIP39 mnemonic phrases used for cryptocurrency wallet recovery. Codenamed BIPClip by ReversingLabs, this software supply chain attack campaign has been active since at least December 2022, with the malicious packages collectively downloaded over 7,000 times before their removal from PyPI. Despite attempts to camouflage their intentions, security researchers found that these packages, such as mnemonic_to_address and erc20-scanner, were crafted to surreptitiously exfiltrate sensitive data to command-and-control servers.
Security researcher Karlo Zanki notes that this campaign underscores the persistent threat posed to cryptocurrency assets by supply chain attackers. The meticulously crafted packages aim to compromise crypto wallets and steal their contents, all while evading suspicion by mimicking legitimate functions and operations. Notably, one of the packages, mnemonic_to_address, appeared benign but served as a gateway for its malicious dependency, bip39-mnemonic-decrypt, highlighting the sophisticated tactics employed by the threat actors behind BIPClip.
ReversingLabs’ investigation reveals that the campaign extends beyond PyPI, with references to a GitHub profile named “HashSnake” and its repository “hCrypto” advertised as tools for extracting mnemonic phrases. Furthermore, the attackers behind HashSnake maintain a presence on Telegram and YouTube, leveraging these platforms to promote their malicious wares. This multi-faceted approach underscores the complex and persistent nature of supply chain attacks targeting cryptocurrency assets.
