---
title: Ongoing massive phishing software attacks - Codenotary
description: Software supply chain attacks are a hot topic. MONITOR & MANAGE THE RISK EXPOSURE OF YOUR APPLICATIONS WITH TRUESBOM®
image: https://codenotary.com/hubfs/Imported_Blog_Media/Blog-Default-Cloud-Feb-10-2023-08-07-19-1640-AM.jpg
---

**$ protect --distro linux --machines 25 --free**

[Start now](https://apps.codenotary.com/linux)

[![cn-logo-black-nobg](https://codenotary.com/hubfs/cn-logo-black-nobg.svg)](https://codenotary.com/)

- Product
  
  #### [![AgentMon Start](https://codenotary.com/hubfs/AgentMon%20Start.svg) **AgentMon Start** Organization-wide AI agent spend, security and device fleet TRY NOW →](https://apps.codenotary.com/agentmon-start)
  
  #### [![AgentMon for Enterprise](https://codenotary.com/hubfs/AgentMon%20for%20Enterprise.svg) **AgentMon** Currently monitors more \> 7 million agent interactions/day. TRY NOW →](https://codenotary.com/agentmon)
  
  #### [![AgentX](https://codenotary.com/hubfs/AgentX.svg) **AgentX** Agentic network control middleware. TRY NOW →](https://codenotary.com/agent-network-control)
  
  #### [![Autonomous Security](https://codenotary.com/hubfs/Autonomous%20Security.svg) **Autonomous Security** AI Agents keep your servers secure. TRY NOW →](https://codenotary.com/trust)
- Use Cases
  
  #### [**AI Agent Risk Monitoring** Continuous oversight of autonomous agents across every environment.](https://codenotary.com/use-cases#risk)
  
  #### [**Autonomous Security Operations** Self-healing defenses that detect, contain, and remediate threats.](https://codenotary.com/use-cases#agentops)
  
  #### [**AI Coding Governance & Performance Monitoring** AI-generated code reviewed, tracked, and held to quality standards.](https://codenotary.com/use-cases#performance)
  
  #### [**AI Tool Cost & Usage Optimization** Spend and consumption optimized across every AI service in use.](https://codenotary.com/use-cases#cost)
  
  #### [**AI Tool Security & Policy Enforcement** Approved AI usage enforced with guardrails and policy controls.](https://codenotary.com/use-cases#security#security)
  
  #### [**Shadow AI Governance** Unsanctioned AI tools discovered, surfaced, and brought under control.](https://codenotary.com/use-cases#shadowit)
- [Blog](https://codenotary.com/blog)
- [Press](https://codenotary.com/press)
- Resources
  
  #### [**Integrations** Connect with your favorite tools and platforms. LEARN MORE →](https://codenotary.com/integrations)
  
  #### [**Support** Get help from our dedicated support team. GET HELP →](https://support.codenotary.com)
  
  #### [**Success Stories** Read how customers achieve their goals. READ MORE →](https://codenotary.com/success)
  
  #### [**Learn** Access documentation and learning resources. EXPLORE →](https://codenotary.com/learn)

[Login](https://apps.codenotary.com/auth/login)

[All posts](https://codenotary.com/blog/all)

 Jan 02, 2023

# Ongoing massive phishing software attacks

 By  [@marcin](https://codenotary.com/blog/author/marcin)  ·   2 minute read

Software supply chain attacks are a hot topic. We have previously warned about [wire fraud scams](https://codenotary.com/blog/using-blockchain-to-protect-against-wire-fraud-scams) and that [those attacks are on the rise](https://codenotary.com/blog/the-rise-of-supply-chain-attacks/). Developers should be aware of recent massive phishing software attacks that target the security of open-source package repositories. [Bleepingcoputer.com](https://www.bleepingcomputer.com/news/security/open-source-repositories-flooded-by-144-000-phishing-packages/amp/) informs of one such attack that targeted NPM, PyPi, and NuGet implanting nearly 145k fake libraries. Codenotary Trustcenter and TrueSBOM are the answer.

![](https://codenotary.com/hs-fs/hubfs/Imported_Blog_Media/DALL%C2%B7E-2022-12-20-09_22_21-Hacker-in-mask-sitting-down-typing-on-a-keyboard-in-a-Linux-terminal-1.png?width=1024&height=1024&name=DALL%C2%B7E-2022-12-20-09_22_21-Hacker-in-mask-sitting-down-typing-on-a-keyboard-in-a-Linux-terminal-1.png)

 Software supply chain attacks are a hot topic

## Anatomy of this software supply chain attack

Hackers conducted an automated attack and uploaded the packages from accounts using a specific naming scheme and featuring similar descriptions. The libraries led to a cluster of 90 domains that hosted over 65,000 phishing pages.

The phishing campaign promotes fake apps, prize-winning surveys, and gift cards and sometimes takes victims to AliExpress via referral links. It was the analysts at [Checkmarx](https://checkmarx.com/)and [Illustria](https://illustria.io/), who discovered the attack. They worked together to uncover and map the infection.

NuGet had the largest share of malicious package uploads (around 140k), while PyPI had 8k infections. Hackers uploaded the libraries in large quantities within a couple of days, which is a common sign of malicious activity. The URL to the phishing sites was implanted in the package description. The goal was to increase the SEO of the phishing sites through links from repositories.

These sites almost always request visitors to enter their email, username, and account passwords, which is where the phishing step takes place. The fake sites feature an element that resembles the promised free generator. When visitors try to use it, asking for “human verification”, it fails. This initiates a series of re-directions to legitimate e-commerce websites using affiliate links, which is how the threat actors generate revenue from the campaign.

The security researchers who discovered the campaign informed NuGet of the infection. In consequence, all packages have since been delisted. The threat actors used an automated method to upload a large number of libraries in such a short time. They could re-introduce the threat using new accounts and different package names at any time.

## Is it so difficult to conduct an attack?

This attack isn’t the only one in recent times. [TrendMicro](https://www.trendmicro.com/en_us/ciso/22/l/software-supply-chain-security.html)notes a 600% increase in the number of attacks. [Other reports](https://www.sonatype.com/state-of-the-software-supply-chain/introduction)find even over 700% increase.

It is worth remembering how easy it is to conduct such attacks. as [a report](https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610)on dependency confusion from an independent security software analyst shows. He has successfully exploited the supply chain of multiple companies by uploading malicious code to public code repositories. He uploaded “malicious” Node packages to the npm registry under unclaimed names, which would “phone home” from each computer. The code inside the packages collected basic information about machines and sent it back to the hacker via DNS exfiltration. The hacker targeted several companies, including PayPal, and was able to get bug bounties from some of them.

## Solution for software supply chain attacks

In conclusion, software developers should be aware of such a hot topic as software supply chain attacks. The risk of phishing attacks through open-source package repositories. They need to take steps to protect themselves and their organizations. This includes being cautious when clicking on links, verifying the authenticity of websites and apps, and using strong, unique passwords for all accounts.

This type of supply chain attack highlights the need to ensure that their internal and external dependencies are secure. You can accomplish this by following the best software security practices outlined in frameworks such as SSDF. You can also gain ongoing visibility into components of your software using tools such as [Trustcenter](https://Codenotary.com/products/trustcenter/)and [TrueSBOM](https://Codenotary.com/blog/apps-need-to-provide-their-own-sbom/).

[![Share on twitter](https://4059529.fs1.hubspotusercontent-na1.net/hub/4059529/hubfs/01-marketplace/twitter-color.png?width=35&height=35&name=twitter-color.png)](https://twitter.com/intent/tweet?original_referer=https://codenotary.com/blog/ongoing-massive-phishing-software-attacks&utm_medium=social&utm_source=twitter&url=https://codenotary.com/blog/ongoing-massive-phishing-software-attacks&utm_medium=social&utm_source=twitter&source=tweetbutton&text=) [![Share on facebook](https://4059529.fs1.hubspotusercontent-na1.net/hub/4059529/hubfs/01-marketplace/facebook-color.png?width=35&height=35&name=facebook-color.png)](http://www.facebook.com/share.php?u=https://codenotary.com/blog/ongoing-massive-phishing-software-attacks&utm_medium=social&utm_source=facebook) [![Share on linkedin](https://4059529.fs1.hubspotusercontent-na1.net/hub/4059529/hubfs/01-marketplace/linkedin-color.png?width=35&height=35&name=linkedin-color.png)](http://www.linkedin.com/shareArticle?mini=true&url=https://codenotary.com/blog/ongoing-massive-phishing-software-attacks&utm_medium=social&utm_source=linkedin) [![Share on pinterest](https://4059529.fs1.hubspotusercontent-na1.net/hub/4059529/hubfs/pinterest.jpg?width=35&height=35&name=pinterest.jpg)](http://pinterest.com/pin/create/button/?url=https://codenotary.com/blog/ongoing-massive-phishing-software-attacks&utm_medium=social&utm_source=pinterest&media=)

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "@marcin",
    "url" : "https://codenotary.com/blog/author/marcin"
  },
  "dateModified" : "2023-02-14T21:18:41.836Z",
  "datePublished" : "2023-01-02T14:43:01.000Z",
  "headline" : "Ongoing massive phishing software attacks - Codenotary",
  "image" : [ "https://codenotary.com/hubfs/Imported_Blog_Media/Blog-Default-Cloud-Feb-10-2023-08-07-19-1640-AM.jpg" ],
  "mainEntityOfPage" : {
    "@id" : "https://codenotary.com/blog/ongoing-massive-phishing-software-attacks",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://codenotary.com/hubfs/logo-light.svg"
    },
    "name" : "Codenotary, Inc."
  }
}
```

```json
{
  "@context" : "http://schema.org",
  "@type" : "Article",
  "author" : {
    "@type" : "Person",
    "name" : [ "@marcin" ],
    "url" : "https://codenotary.com/blog/author/marcin"
  },
  "datePublished" : "2023-01-02T14:43:01+0000",
  "description" : "Software supply chain attacks are a hot topic. MONITOR & MANAGE THE RISK EXPOSURE OF YOUR APPLICATIONS WITH TRUESBOM®",
  "headline" : "Ongoing massive phishing software attacks",
  "image" : "https://23873599.fs1.hubspotusercontent-na1.net/hubfs/23873599/Imported_Blog_Media/Blog-Default-Cloud-Feb-10-2023-08-07-19-1640-AM.jpg",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://cdn2.hubspot.net/hubfs/23873599/logo-light.svg"
    },
    "name" : ""
  },
  "url" : "https://codenotary.com/blog/ongoing-massive-phishing-software-attacks"
}
```