New Phishing Scam Aims at PyPI Maintainers to Steal Login Information

A fresh domain-confusion phishing campaign is targeting PyPI maintainers, with malicious actors trying to harvest login credentials by sending unsolicited emails that urge recipients to “verify your email address” under the guise of account maintenance and security procedures. The scam redirects victims to pypi-mirror[.]org, a site unaffiliated with the Python Packaging Authority (PSF) or the official PyPI registry, and mirrors legitimate PyPI branding to lure users into entering usernames and passwords.

The attackers can gain access to sensitive package metadata or potentially publish malicious versions of popular libraries, a risk that underscores why this campaign echoes a July 2025 wave while using a different deceptive domain.

According to PyPI’s defenders, steps include notifying registrars and content-delivery networks to disable the offending domains and submitting phishing URLs to threat intelligence feeds and browser blocklists, as well as exploring hardware security keys to bolster phishing-resistant authentication alongside existing 2FA.

Best practices for maintainers emphasise never clicking unsolicited links, using pypi[.]org to verify notifications, and adopting phishing-resistant 2FA methods such as FIDO2 hardware tokens, while reviewing security histories and alerting peers.