Full Report
Cybersecurity researchers have disclosed a malicious package uploaded to the Python Package Index (PyPI) repository that's designed to reroute trading orders placed on the MEXC cryptocurrency exchange to a malicious server and steal tokens. The package, ccxt-mexc-futures, purports to be an extension built on top of a popular Python library named ccxt (short for CryptoCurrency eXchange Trading),
Analysis Summary
# Tool/Technique: ccxt-mexc-futures (Supply Chain Attack)
## Overview
The **ccxt-mexc-futures** package is a malicious Python tool uploaded to the PyPI repository, designed to hijack trading orders on the MEXC cryptocurrency exchange. It reroutes API requests to a malicious server, exfiltrating sensitive data such as API keys and secrets. The package is no longer available on PyPI but has been downloaded over 1,065 times, posing a significant supply chain threat.
---
## Technical Details
- **Type**: Tool
- **Platform**: Python (targeting developers using PyPI)
- **Capabilities**:
- Overrides MEXC APIs (`contract_private_post_order_submit`, `contract_private_post_order_cancel`)
- Introduces a malicious API (`spot4_private_post_order_place`)
- Redirects requests to a spoofed domain (`v3.mexc.workers[.]dev`)
- Exfiltrates API keys and secrets to a malicious server (`greentreeone[.]com`)
- **First Seen**: April 15, 2025
---
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- **T1552.001 - Exploit Public-Facing Application** (via compromised PyPI package)
- **T1562 - Exploit Public-Facing Application** (supply chain compromise)
- **T1021 - Exfiltration** (data exfiltration via malicious C2)
---
## Functionality
### Core Capabilities
- **API Hijacking**: Overrides MEXC's private API endpoints to intercept trading orders.
- **Request Redirection**: Redirects traffic to a spoofed domain (`v3.mexc.workers[.]dev`) to mimic MEXC.
- **Credential Theft**: Steals API keys and secrets from victims' systems.
### Advanced Features
- **Persistence**: Embeds malicious logic within legitimate libraries to maintain long-term access.
- **Stealth**: Uses legitimate package names to evade detection and blend with trusted software.
---
## Indicators of Compromise
- **File Hashes**: Not disclosed (package removed from PyPI).
- **File Names**: `ccxt-mexc-futures` (malicious)
- **Registry Keys**: Not applicable.
- **Network Indicators**:
- C2 domains: `v3.mexc.workers[.]dev` (spoofed), `greentreeone[.]com` (malicious)
- **Behavioral Indicators**:
- Unusual API calls to MEXC endpoints.
- Exfiltration of sensitive data (API keys, secrets) to external servers.
---
## Associated Threat Actors
- **Supply Chain Attackers**: Likely state-sponsored or financially motivated groups leveraging PyPI and other package repositories.
- **Slopsquatting Actors**: Exploit AI hallucinations to register deceptive packages (e.g., "ccxt-mexc-futures").
---
## Detection Methods
- **Signature-Based**: Monitor for the presence of `ccxt-mexc-futures` in dependencies.
- **Behavioral**: Detect anomalous API requests to spoofed domains or exfiltration of credentials.
- **YARA Rules**: Not explicitly mentioned, but custom rules can target malicious API overrides.
---
## Mitigation Strategies
- **Prevention**:
- Remove the `ccxt-mexc-futures` package immediately.
- Revoke compromised API keys and tokens.
- **Hardening**:
- Use code signing and dependency verification tools (e.g., Snyk, Dependabot).
- Monitor PyPI and other repositories for suspicious packages.
---
## Related Tools/Techniques
- **Supply Chain Attacks**: npm, Go, Maven package compromises (e.g., "slopsquatting").
- **Malicious Libraries**: Other compromised PyPI packages (e.g., "ccxt" with malicious extensions).
- **Threat Intelligence**: Track AI hallucination-driven package registrations (e.g., "deceptive delight" attacks).
---
**Note**: This attack highlights the risks of untrusted third-party dependencies and underscores the need for rigorous supply chain security practices.