SilentSync RAT Delivered via Two Malicious PyPI Packages Targeting Python Developers

Two new malicious PyPI packages, sisaws and secmeasure, were found delivering a Windows-focused remote access trojan named SilentSync, with both packages now removed from PyPI. Zscaler ThreatLabz described SilentSync as capable of remote command execution, file exfiltration, and screen capturing, and noted it also extracts browser data such as credentials, history, autofill data, and cookies from Chrome, Brave, Edge, and Firefox.

The packages, uploaded by a user named CondeTGAPIS, include sisaws which mimics the legitimate Python package sisa and contains a gen_token() function that downloads a secondary Python script for in-memory execution, and secmeasure which masquerades as a library for cleaning strings but harbours SilentSync functionality.

SilentSync is primarily aimed at Windows but also carries Linux and macOS capabilities, including Registry modifications on Windows, crontab changes on Linux for startup execution, and a LaunchAgent on macOS. The malware communicates with a hard-coded endpoint at 200.58.107[.]25 to fetch code from four endpoints—/checkin, /comando, /respuesta and /archivo—for command execution and data exfiltration, after which artifacts are deleted to evade detection, according to Zscaler.