MAL-2024-11562 Malicious code in cometlogger (PyPI)

Multi-purpose infostealer, including grabbing cookies, files, information from cryptowallets; injecting code into discord application. This package is a builder for the actual malware

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2024-11-cometlogger

Reasons (based on the campaign):

• infostealer

• files-exfiltration

• peristence-autorun

• clipboard-stealing

• exfiltration-generic

• exfiltration-crypto

• exfiltration-browser-data

• The package contains code to detect if it is running in a sandbox environment.