This threat involves a supply chain compromise of the Microsoft DurableTask Python client on PyPi, affecting versions 1.4.1 to 1.4.3. The attacker gained access by compromising a GitHub account previously linked to attacks and extracted GitHub secrets containing PyPi tokens. The malicious payload targets Linux environments to steal credentials from multiple cloud platforms and password managers. It spreads laterally using AWS Systems Manager (SSM) and Kubernetes mechanisms, with a propagation limit of five targets per infected host. The malware collects shell history, attempts brute force attacks on password managers, and establishes persistence via infection markers. The compromised packages have been quarantined, but no explicit patch or fix details are provided.

The attack enables credential theft from critical cloud infrastructure and password management tools, potentially allowing unauthorized access to cloud resources and sensitive data. Lateral movement capabilities increase the risk of broader network compromise within affected environments. The infection persistence and credential harvesting techniques pose a medium-level threat to affected Linux systems using the compromised DurableTask client versions.

The compromised DurableTask packages on PyPi have been quarantined following analysis. No official patch or remediation instructions are provided in the available information. Users should avoid using the affected versions (1.4.1, 1.4.2, 1.4.3) of the DurableTask Python client until further guidance or fixed versions are released by the vendor. Monitor official vendor advisories and trusted sources for updates on remediation.