Malicious code in dstill (PyPI)

The 'dstill' PyPI package version 0.3.0 executes a multi-stage Windows infostealer when imported. It reads and decrypts Roblox cookies from local storage and exfiltrates them to a Discord webhook and a Google Apps Script endpoint. It forcibly terminates Discord processes, enumerates multiple Discord clients and Chromium-based browsers plus Firefox profiles, decrypts stored tokens using DPAPI master keys, validates them via the Discord API, and exfiltrates valid tokens to the same endpoints. Persistence is established by copying the malware to a MicrosoftSecurityWorker folder with Windows Defender exclusion and creating a scheduled task named 'WindowsSecurityUpdate' to run at logon. The malware uses Microsoft-lookalike file paths and Russian/Ukrainian comments to evade detection and target Roblox developers.

This malicious package compromises user privacy and security by stealing Roblox cookies and Discord tokens, enabling unauthorized access to user accounts and potentially further abuse. The persistence mechanism and AV evasion techniques increase the difficulty of detection and removal, posing a significant risk to affected systems.

No official patch or remediation is currently documented. Users should immediately uninstall the 'dstill' package version 0.3.0 and avoid using this package. Conduct thorough endpoint scans for persistence artifacts such as the 'WindowsSecurityUpdate' scheduled task and the MicrosoftSecurityWorker folder. Remove any detected malicious files and scheduled tasks. Monitor for suspicious network traffic to the identified exfiltration endpoints. Follow vendor advisories if they become available for updated remediation guidance.