Malicious PyPI Package Mimics as SOCKS5 Proxy Tool Attacking Windows Platforms

According to JFrog’s security research team, a malicious PyPI package named SoopSocks masquerades as a SOCKS5 proxy tool but implants a backdoor on Windows systems. The threat uses automated installation and persistence techniques, including a Windows service that runs with SYSTEM privileges and opens port 1080 via Windows Firewall rules, plus a Discord webhook for real-time telemetry.

SoopSocks propagates through three main vectors: a Go-compiled primary installer that registers as “SoopSocksSvc” at C:\Program Files\socks5svc\socks5svc.exe, a legacy VBScript route that downloads a portable Python distribution and elevates via UAC, and direct Python module installation via pip install soopsocks pywin32 which triggers a service installation, firewall configuration, and a scheduled task fallback.

It also exfiltrates network data every 30 seconds to a hardcoded Discord webhook, including hostname, local and public IPs, and connection type. Mitigations recommended include auditing Python dependencies, enforcing least privilege for service installs, monitoring outbound Discord traffic, and disabling automatic Python module installs via VBScript where feasible, with further hardening through restricted PowerShell policy.