Subj : Popular Python AI library hacked to deliver malware
To   : All
From : TechnologyDaily
Date : Mon Dec 09 2024 16:15:04

Popular Python AI library hacked to deliver malware

Date:
Mon, 09 Dec 2024 16:13:00 +0000

Description:
YOLO11 used to drop XMRig on people's computers, but the attack has since 
been addressed.

FULL STORY
======================================================================A PyPI 
package for an AI model was compromised and used to deliver malware Victims 
were getting XMRig, a popular cryptominer, installed The attack has since 
been addressed, but users warned to be on their guard 

Ultralytics YOLO11, an AI model for computer vision and object detection, was 
compromised in an apparent supply chain attack, and used to deploy malware on 
victim devices. 

The attack was confirmed by the companys founder, who also said the incident 
was remedied, and the malicious version pulled - however, it seems that new 
malicious versions have popped up again. 

YOLO11 (short for You Only Look Once), is an AI model designed for real-time 
computer vision tasks, such as identifying objects, analyzing images, and 
detecting poses. The service is quite popular, being starred more than 30,000 
times, forked on GitHub more than 6,000 times, and counts hundreds of 
thousands of downloads a day. Newer attacks 

As an open source solution, YOLO11 was also available for download on PyPI, 
one of the worlds biggest Python package repositories. 

There, an unidentified threat actor recently broke into the account and 
uploaded two versions - 8.3.41, and 8.3.42. Those who updated to these 
versions, either directly or through a dependency, ended up with a 
cryptocurrency miner on their devices. 

The miner installed is called XMRig, and it is by far the most popular 
cryptojacker (a hijacker malware that mines crypto) out there. XMRig is known 
for generating Monero (XMR), a privacy-oriented currency that is difficult to 
trace. 

Ultralytics founder and CEO Glenn Jocher confirmed the attack, and said it 
was addressed: "We confirm that Ultralytics versions 8.3.41 and 8.3.42 were 
compromised by a malicious code injection targeting cryptocurrency mining. 
Both versions have been immediately removed from PyPI," Jocher posted to 
GitHub. "We have released 8.3.43 which addresses this security issue. Our 
team is conducting a full security audit and implementing additional 
safeguards to prevent similar incidents." 

However, over the weekend BleepingComputer said there were user reports of 
even newer versions - 8.3.45, and 8.3.46, who were trojanized. At press time, 
GitHub shows 8.3.48 as the newest version. 

 Via BleepingComputer You might also like PyPI stops signing up new users to 
try and block malware campaign Here's a list of the best antivirus These are 
the best endpoint protection tools right now



======================================================================
Link to news story:
https://www.techradar.com/pro/security/popular-python-ai-library-hacked-to-del
iver-malware


--- Mystic BBS v1.12 A47 (Linux/64)
 * Origin: tqwNet Technology News (1337:1/100)

.