python-bitget-wrapper @0.3.7

Summary

Importing the module starts an obfuscated PowerShell code, which downloads and executes a remote script. On Windows, the script appears to just start the calculator. On MacOS, the file is identified as a Spark RAT by multiple vendors. Package impersonate the legitimate "python-bitget". --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2024-12-python-bitget-api Reasons (based on the campaign): - typosquatting - obfuscation - clones-real-package - dependency-confusion - crypto-related - impersonation - Downloads and executes a remote malicious script.

Source: kam193 (769187e87797e69e9ebfc00eb97274a91fea1c86b1472b4ef6436441f737c8b9)