PyPI Warns of Ongoing Phishing Campaign Using Fake Verification Emails and Lookalike Domain

Threat Score:
51
The Hacker News
12 days ago

Overview

The maintainers of the Python Package Index (PyPI) repository have issued a warning an ongoing phishing attack that's targeting users in an attempt to redirect them to fake PyPI sites. The attack involves sending email messages bearing the subject line "[PyPI] Email verification" that are sent from the email addressnoreply@pypj[.]org(note that the domain is not "pypi[.]org"). "This is not a security breach of PyPI itself, but rather a phishing attempt that exploits the trust users have in PyPI,"...

Related Articles

5 articles
2

ClickFix macOS Malware Targets User Login Credentials

GB Hackers • 6 hours ago

ClickFix macOS Malware Targets User Login Credentials Security researchers have identified a new malware campaign targeting macOS users through a sophisticated ClickFix technique that combines phishing and social engineering to steal cryptocurrency wallet details, browser credentials, and sensitive personal data. The Odyssey Stealer malware,discoveredby X-Labs researchers in August 2025, represents an evolution of earlier ClickFix attacks that previously focused on Windows systems, now expanding

Score
78
Read more
3

Hackers Found Backdoor in High-Security Safes—Opens in Seconds

Spybusters • 2 hours ago

Security researchers found two techniques to crack at least eight brands of electronic safes—used to secure everything from guns to narcotics. James Rowley and Mark Omo got curious a scandal in the world of electronic safes... In the process, they'd find something far bigger: another form of backdoor intended to let authorized locksmiths open not just Liberty Safe devices, but the high-security Securam Prologic locks used in many of Liberty’s safes and those of at least seven other brands.  More

Score
77
Read more
4

Researchers Detail Windows EPM Poisoning Exploit Chain Leading to Domain Privilege Escalation

The Hacker News • 5 hours ago

Cybersecurity researchers havepresentednew findings related to a now-patched security issue in Microsoft's Windows Remote Procedure Call (RPC) communication protocol that could be abused by an attacker to conduct spoofing attacks and impersonate a known server. The vulnerability, tracked as CVE-2025-49760 (CVSS score: 3.5), has been described by the tech giant as a Windows Storage spoofing bug. It was fixed in July 2025 as part of its monthly Patch Tuesday update. Details of the security defect

Score
75
Read more
5
DEF CON hackers plug security holes in US water systems amid tsunami of threats

DEF CON hackers plug security holes in US water systems amid tsunami of threats

Theregister • 6 hours ago

Security DEF CON hackers plug security holes in US water systems amid tsunami of threats Five pilot deployments are just a drop in the bucket, so it's time to turbo scale def conA DEF CON hacker walks into a small-town water facility…no, this is not the setup for a joke or a (super-geeky) odd-couple rom-com. It's a true story that happened at five utilities across four states. And now, nine months intoproviding free cybersecurity servicesto a handful of American critical infrastructure systems,

Score
75
Read more