---
title: Malicious Lolip0p PyPI Packages Drop Wacatac
description: Three malicious PyPI packages uploaded by user Lolip0p were recently discovered dropping Wacatac.
---

[Insights, news, education and announcements from PolySwarm](https://blog.polyswarm.io)

# [Malicious Lolip0p PyPI Packages Drop Wacatac](https://blog.polyswarm.io/malicious-lolip0p-pypi-packages-drop-wacatac)

 Written by [The Hivemind](https://blog.polyswarm.io/author/the-hivemind) | Jan 27, 2023 7:58:20 PM

**Related Families:** Wacatac

**Executive Summary**

Fortinet recently [reported](https://www.fortinet.com/blog/threat-research/supply-chain-attack-using-identical-pypi-packages-colorslib-httpslib-libhttps) on a supply chain attack in which threat actors leveraged a 0-day attack embedded in three PyPI packages to deliver Wacatac.

**Key Takeaways**

- In a recent supply chain attack, threat actors used a 0-day attack embedded in three PyPI packages to deliver a malicious payload.
- The malicious packages were all uploaded by the user Lolip0p.
- The payload was Wacatac, an information stealer. 

## **Background** In our recent[PolySwarm’s 2023 Analyst Predictions](https://blog.polyswarm.io/polyswarms-2023-analyst-predictions) threat bulletin, we predicted threat actors would continue the software supply chain attacks trend, including targeting open-source code repositories. Fortinet recently reported on a supply chain attack in which threat actors leveraged a 0-day attack embedded in three PyPI packages. Affected packages included ‘colorslib’, ‘httpslib’, and ‘libhttps’. All three packages were published in early January by a user known as Lolip0p. Based on their profile information, Lolip0p apparently joined the PyPI repository shortly before posting the first two packages on January 7th. The third package was published on January 12th. The packages were given a legitimate-looking description but were all malicious. According to researchers at Fortinet, all three packages have an identical setup.py script. All three run a PowerShell script with a suspicious URL that leads to the download of a binary, Oxyz.exe. Oxyz.exe drops another executable, update.exe, that runs in a temp folder and drops multiple files into the folder. One of the dropped files is SearchProtocolHost.exe, which is detected as the Wacatac trojan. **What is Wacatac?** Wacatac is an information stealer that gathers multiple types of victim information, including login credentials and banking information. Threat actors can use Wacatac to deploy additional payloads, such as ransomware. **IOCs** PolySwarm has multiple samples associated with this activity. <https://polyswarm.network/scan/results/file/8dc8a9f5b5181911b0f4a051444c22e12d319878ea2a9eaaecab9686e876690b>[8dc8a9f5b5181911b0f4a051444c22e12d319878ea2a9eaaecab9686e876690b](https://polyswarm.network/scan/results/file/8dc8a9f5b5181911b0f4a051444c22e12d319878ea2a9eaaecab9686e876690b) (Oxyz.exe)

[293a3a2c8992636a5dba58ce088feb276ba39cf1b496b336eb7b6f65b1ddb757](https://polyswarm.network/scan/results/file/293a3a2c8992636a5dba58ce088feb276ba39cf1b496b336eb7b6f65b1ddb757) (Update.exe)

 

You can use the following CLI command to search for all related samples in our portal:

**$ polyswarm link list -f Lolip0p

*Don’t have a PolySwarm account? Go [here](https://polyswarm.network/) to sign up for a free Community plan or to subscribe.

Contact us at [hivemind@polyswarm.io](mailto:hivemind@polyswarm.io) | Check out our [blog](https://blog.polyswarm.io/) | [Subscribe](https://polyswarm.io/ransomwarereport/) to our reports***

[View full post](https://blog.polyswarm.io/malicious-lolip0p-pypi-packages-drop-wacatac)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "The Hivemind"
  },
  "dateModified" : "2023-01-27T19:58:20.933Z",
  "datePublished" : "2023-01-27T19:58:20Z",
  "headline" : "Malicious Lolip0p PyPI Packages Drop Wacatac",
  "image" : {
    "@type" : "ImageObject",
    "height" : 1406,
    "url" : "https://5737925.fs1.hubspotusercontent-na1.net/hubfs/5737925/malicious%20lolip0p.jpg",
    "width" : 2500
  },
  "mainEntityOfPage" : "https://blog.polyswarm.io/malicious-lolip0p-pypi-packages-drop-wacatac",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60.0,
      "url" : "https://cdn2.hubspot.net/hubfs/5737925/Social%20Icons_PS-1.png",
      "width" : 59.820896
    },
    "name" : "The PolySwarm Blog"
  }
}
```