New Phishing Campaign Targets PyPI Maintainers with Fake Domain

The Daily CyberSecurity reports a new phishing campaign aimed at PyPI maintainers, this time employing domain confusion and convincing emails to steal credentials. According to Seth Larson, Security Developer-in-Residence at the PSF, the string of phishing attacks using domain-confusion and legitimate-looking emails continues, the same attack PyPI saw a few months ago but with a different domain name.

The latest messages claim maintainers must verify their account information to prevent suspension, directing victims to a site hosted at pypi-mirror[.]org, a domain not owned by PyPI or the PSF. The guidance from the article urges anyone who has clicked the link or entered credentials to change their PyPI password immediately and to inspect their account’s Security History for anything unexpected.

Victims are also advised to report suspicious activity to security@pypi[.]org so the PSF can track and mitigate such attacks. The piece emphasises that attackers imitate trusted infrastructure to target the software supply chain and that vigilance, phishing-resistant authentication, and ecosystem-wide alerts are vital.