Deep-Live-Cam GitHub repo compromised: malicious dependency loads cryptocurrency clipboard hijacker on Windows and macOS

Linha do tempo

1. safedep.io ↗ · pub. 08/09/2026 21:00 · coletado 19/10 18:03 primeiro registro

   Deep-Live-Cam GitHub repo compromised: malicious dependency loads cryptocurrency clipboard hijacker on Windows and macOS

   ler a análise desta fonte ocultar

   On September 8, 2026, an attacker added a malicious source dependency to Deep-Live-Cam, a Python face-swapping app with about 96,600 GitHub stars. Commit 7895c547 ("chore: update requirements.txt") rewrote 18 dependency entries and added requests @ git+https://github.com/pypls/requests.git. This points installation to a lookalike repository that runs a loader at build time. The loader downloads a clipboard hijacker for Windows and macOS that swaps cryptocurrency wallet addresses and persists across logins. The malicious revision stayed on main for about 9 hours 39 minutes. The maintainer reported unusual account access despite 2FA, which supports an account compromise assessment. SafeDep notes the evidence does not establish infection counts or financial losses.

   Technical Details

   • Infrastructure prep: the pypls GitHub account and its requests repo were created on September 5, three days before the commit. A Telegraph page carries the same date.
   • Build-time execution: the dependency uses the setuptools backend, so setup.py runs during pip metadata or wheel build, before Deep-Live-Cam is launched. Line 2 of setup.py hides the code behind 434 spaces, plus CJK variable names. It uses a Base64 + zlib exec(compile(...)) chain, run before the Python version check.
   • Stage 2 loader: it exits on non-Windows/macOS systems and fetches hxxps://graph[.]org/coding-utf-8-09-05-2. It extracts Python from the <article> body and writes it to %LOCALAPPDATA%\WindowsHelper\sys.pyw (Windows) or ~/Library/Application Support/HowToFind/sys.py (macOS). It runs the script hidden, with output discarded, and pings hxxps://abacus[.]jasoncameron[.]dev/hit/duff[.]com/info after a new write. That ping is likely a counter and does not prove execution.
   • Final payload: it polls the clipboard every 0.3 s, finds 26-120 character alphanumeric candidates, validates them (Base58Check, Bech32/Bech32m, Keccak-256/EIP-55, Solana 32-byte Base58) and replaces them with hardcoded attacker addresses. It covers Bitcoin, Ethereum, Tron and Solana. A Russian error string ("Неизвестный тип кошелька") is a weak language-origin indicator.
   • Persistence: on Windows, the SysHelper value under HKCU\Software\Microsoft\Windows\CurrentVersion\Run. On macOS, ~/Library/LaunchAgents/com.user.syshelper.plist with RunAtLoad and KeepAlive, loaded via launchctl.
   • Linux clipboard helpers exist in the payload, but the loader exits on Linux, so this delivery path does not expose Linux.
   • The network indicators are specific paths on shared services, not whole domains.

   Remediation

   • Reverting requirements.txt does not remove files or startup entries from affected machines.
   • Check whether anyone installed or updated Deep-Live-Cam dependencies while the malicious revision was on main (Sept 8, 2026).
   • On affected hosts, look for the WindowsHelper\sys.pyw or HowToFind/sys.py files, the SysHelper Run key, and the com.user.syshelper.plist LaunchAgent, and remove them.
   • Treat wallet addresses copied on affected hosts as potentially swapped, and verify addresses before sending funds.
   • Audit bulk dependency rewrites and git-URL dependencies in review, and rotate maintainer credentials and sessions.