Malicious Soopsocks PyPI Package Infects Thousands With Stealth Windows Backdoor

A malicious software package called "soopsocks" slipped into the Python Package Index (PyPI), deploying a covert Windows backdoor and compromising over 2,600 systems before its removal. The incident exposes ongoing vulnerabilities in open-source software repositories and highlights the need for stronger supply chain security practices.

Key Takeaways

• Soopsocks masqueraded as a SOCKS5 proxy tool but delivered a sophisticated Windows backdoor.

• The package exploited PowerShell and VBScript to gain persistence and escalate privileges.

• Over 2,600 systems were potentially compromised, with stolen data exfiltrated via Discord.

• The threat exemplifies broader trends in software supply chain attacks and points to gaps in existing defenses.

How Soopsocks Infiltrated Systems

Cybersecurity researchers flagged soopsocks after noticing suspicious activity. Officially uploaded to PyPI on September 26, 2025, the package promised proxy capabilities but surreptitiously embedded an executable (_AUTORUN.EXE) containing advanced malicious elements. During installation, it launched scripts that downloaded additional files, installed the software as a persistent service, and manipulated Windows firewall and scheduled tasks to maintain a foothold.

The malware used privilege escalation techniques to achieve SYSTEM-level access, altering firewall rules and enabling long-term, hidden control over victim machines. It then exfiltrated sensitive details such as usernames, system information, and IP addresses to a hardcoded Discord webhook—a tactic becoming increasingly common among malware authors for command-and-control purposes.

The Growing Threat of Supply Chain Attacks

Recent months have seen a surge in supply chain attacks on ecosystems like PyPI. Attackers leverage the trust built into open-source repositories, quickly pushing malicious packages to unsuspecting developers.

Previous incidents referenced similar credential-stealing malware, with one campaign in early 2025 compromising over 14,000 installations. Soopsocks advanced these tactics, demonstrating how even short-lived packages can inflict significant damage. Its brief time online  just a few days  was enough to compromise thousands of systems due to the sheer scale and automation of modern dependency management.

Lessons for Developers and Defenders

This incident highlights several key areas for improvement:

• Vigilance With Dependencies: Always verify the authenticity of third-party packages—check metadata, scrutinize update history, and favor well-known maintainers.

• Automated Auditing Tools: Use tools like pip-audit and employ firewalls that flag suspicious or transitive dependencies.

• Shorter Token Lifetimes: Security best practices now advocate for minimal-duration access tokens to reduce exposure if credentials are stolen.

• Segment Development Environments: Isolate systems used for software development to contain potential breaches.

Best Practice	Benefit
Audit Dependencies	Reduce risk of installing malicious code
Use Virtual Envs	Isolate risks to specific projects
Enable MFA/2FA	Add friction to prevent unauthorized access
Monitor for Anomalies	Quickly detect unexpected package behavior

The Road Ahead for Open Source Security

Despite a quick response and takedown by PyPI maintainers, soopsocks' impact underscores persistent challenges in securing open-source ecosystems. Experts urge enhanced AI-based threat detection and a culture of skepticism, especially for new or unfamiliar packages. As attackers refine their methods and aim for stealthier, more persistent malware, collaboration between developers, registry administrators, and security firms is crucial to preventing future breaches.

Sources

• Alert: Malicious PyPI Package soopsocks Infects 2,653 Systems Before Takedown, The Hacker News.

• Malicious Soopsocks Package on PyPI Deploys Windows Backdoor, Hits 2,653 Downloads, WebProNews.