PyPI Warns Users of Fresh Phishing Campaign

PyPI is warning users about a fresh phishing campaign that relies on domain confusion to harvest credentials, a continuation of a campaign conducted in July. Threat actors impersonating PyPI ask recipients to verify their email address for security purposes and direct them to fake websites. The campaign notes that the malicious link goes to pypi-mirror[.]org, a domain not owned by PyPI or the PSF.

According to PSF security developer-in-residence Seth Larson, this email is fake and the link leads to a domain not owned by PyPI or the PSF. Those who clicked and entered credentials on the fake site are advised to rotate their credentials, check their account’s security history for anomalies, and report suspicious activity.

The piece also mentions a recent phishing attack targeting NPM package maintainers with similar MFA-verification tactics, illustrating a pattern of credential theft aimed at open source ecosystems.