Malicious Typosquatted PyPI Packages Spreading SilentSync RAT

On 4 August 2025, two malicious PyPI packages named sisaws and secmeasure were discovered by Zscaler ThreatLabz to deliver SilentSync, a Python-based remote access trojan (RAT), to unsuspecting developers via typosquatting of legitimate libraries. The packages impersonate legitimate PyPI libraries and deploy SilentSync upon import, posing a serious supply-chain risk to projects that install them.

SilentSync offers remote command execution, file exfiltration (with ZIP compression), and screenshot capture, and it targets Windows systems while including persistence via a Run key in the Windows registry. It also exfiltrates browser data from Chrome, Brave, Edge, and Firefox and communicates over HTTP to a hardcoded C2 server, using beaconing and REST endpoints for control.

ThreatLabz noted rapid iteration with four releases between 3 and 4 August 2025 for secmeasure versions 0.1.0, 0.1.1, 0.1.2, and sisaws version 2.1.6, underscoring the evolving nature of the threat.