Backdoor Disguised as SOCKS5 Proxy: Malicious PyPI Package SoopSocks Grants Root Access

Security researchers from JFrog uncovered a malicious PyPI package named SoopSocks (XRAY-725599) that masqueraded as a SOCKS5 proxy tool but operated as a backdoor with persistence and reconnaissance features. The package, which evolved from a basic proxy to a GO-based EXE, promised to create a SOCKS5 proxy service while reporting information to a configurable Discord webhook, yet acted as a backdoor proxy server targeting Windows platforms.

According to JFrog, the executable contains a hardcoded Discord webhook and PowerShell scripts that run automatically, including firewall rules and other scripts, and SoopSocks employs multiple persistence techniques such as a Windows service (SoopSocksSvc) with SYSTEM privileges, Scheduled Tasks, firewall rule modifications to allow inbound traffic on port 1080, and a UAC bypass through hidden PowerShell execution.

Once active, it reports back to the Discord webhook every 30 seconds and leaks hostnames, local and public IPs, and system fingerprints. The SoopSocks package was removed from PyPI on 29 September 2025 at 6:00 PM GMT+3 after JFrog reported it as suspicious.