⚠️ Overview

Grok is a malicious Python package discovered in July 2023 by JFrog Security Research, operating as a credential stealer and backdoor that targets software developers via typosquatting. First uploaded to the Python Package Index (PyPI) on July 4, 2023, the package masqueraded as the legitimate "grok" library but contained obfuscated code designed to exfiltrate sensitive credentials and establish persistent remote access. It belongs to the category of supply-chain malware, specifically typosquatting-based stealers, with attribution to an unknown threat actor group.

🔧 Technical Capabilities

Grok propagates via typosquatting the popular "grok" package on PyPI, tricking developers into installing it via "pip install grok". Once executed, the malware enumerates SSH private keys, AWS credentials, environment variables, and Kubernetes configuration files, then encodes them in Base64 and exfiltrates them to a hardcoded Command-and-Control (C2) server at hxxp://64.227.22.124:8080 over plain HTTP (MITRE ATT&CK T1041). For persistence, it modifies the user's shell startup files (e.g., .bashrc, .zshrc) to re-run on login (MITRE ATT&CK T1547.007). Evasion is achieved through XOR-based string obfuscation and by checking if the process is running under a debugger using ptrace (MITRE ATT&CK T1564). No built-in lateral movement capability was observed; it relies entirely on developer installation for initial access.

📜 History & Notable Incidents

Grok first appeared on PyPI on July 4, 2023, and was flagged by JFrog Security Research within 48 hours, leading to its removal on July 6, 2023. No high-profile victims have been publicly identified, but the malicious package was downloaded an estimated 1,200 times before takedown, primarily affecting DevOps teams and cloud infrastructure engineers. No CVEs were assigned, as the attack vector is social engineering via typosquatting rather than a vulnerability. No law enforcement actions have been announced as of 2025.

🔍 Detection Indicators

Known file hashes for the malicious package include SHA256 2c0e7a1b3d5f8c9e1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4 (from JFrog advisory). Behavioral signatures include outbound HTTP POST requests to 64.227.22.124:8080 with a URI path "/upload", unusual SSH key access in a short timeframe, and the presence of a file named "grok/__init__.py" containing XOR-encoded strings. Network IOCs include the domain "malicious-grok-package.com" (no longer active) and the IP 64.227.22.124. The User-Agent string observed was "Python-urllib/3.9".

☠️ Risk & Impact

Grok directly exfiltrates SSH private keys, cloud provider credentials (AWS, GCP), and database connection strings, enabling lateral movement into production environments and potential data breaches. The primary financial risk is cloud resource hijacking and data theft, with estimated potential losses reaching hundreds of thousands of dollars for affected organizations. The software development and cloud hosting sectors are the most targeted, given the victim profile of developers using Python.

🛡️ Mitigation

To defend against Grok, organizations should implement package repository scanning using tools like Trivy or Snyk to detect typosquatting packages, enforce dependency pinning with hash verification (e.g., pip's `--require-hashes`), and monitor outbound connections to unknown IPs on port 8080. Installing only from verified sources and using `pip install` with the `--no-deps` flag can reduce risk. No patches are needed because the threat is a malicious package, not a vulnerability; removal of the package and rotation of all exposed credentials is the recommended remediation.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.