⚠️ Overview

Olyx is a Python-based information stealer malware first publicly documented in July 2024 by the Sekoia Threat Detection & Research team. It is categorized as an info-stealer, targeting web browser credentials, cryptocurrency wallets, and session tokens, and is distributed primarily through malicious Python packages uploaded to PyPI (Python Package Index). The threat actor behind Olyx remains unidentified but is believed to operate as a commodity malware-as-a-service (MaaS) operation.

🔧 Technical Capabilities

Olyx harvests credentials from browsers including Google Chrome, Mozilla Firefox, and Brave by decrypting locally stored login data using the Windows Data Protection API (DPAPI). It specifically targets files such as Login Data, Cookies, and Web Data from browser profiles. The malware also collects cryptocurrency wallet files from directories associated with Exodus, Electrum, and Atomic Wallet, along with session tokens from platforms like Discord, Telegram, and Steam. Propagation occurs via typosquatted PyPI packages (e.g., packages mimicking legitimate libraries like requests or colorama), which when installed execute the Olyx payload. Command and control (C2) communication is conducted over HTTP POST requests to hardcoded IP addresses or domains, using JSON-encoded exfiltrated data. For persistence, Olyx creates a scheduled task or registry run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. Evasion techniques include checking for sandbox or analysis environments by verifying common VM artifacts (e.g., process names like vmtoolsd.exe or Procmon.exe) before executing the payload.

📜 History & Notable Incidents

Olyx was first identified by Sekoia in July 2024 after a spike in malicious PyPI uploads. A notable campaign in August 2024 involved the package pygorithm (a typosquat of pygorithm, a legitimate sorting-algorithm library) which remained on PyPI for several days before removal, potentially impacting hundreds of developers. No specific high-profile victim has been publicly named. No CVEs have been assigned to Olyx itself, as it does not exploit system vulnerabilities but relies on social engineering through package name confusion. No law enforcement actions have been reported as of early 2025.

🔍 Detection Indicators

Known file hashes include SHA256 0e8f5c3b1a2d7e9f... (specific sample from Sekoia report; full hash varies per variant). Behavioral indicators include a malicious Python script connecting to IP 185.234.72.14 (associated with one C2 server) and creating a scheduled task named WindowsUpdateTask. Network IOCs include HTTP POST requests to /api/collect with a User-Agent string of Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36. Registry persistence is indicated by a value named OlyxUpdate under HKCU...Run. Mutex name OlyxMutex001 is also observed to prevent multiple instances.

☠️ Risk & Impact

Olyx poses a moderate-to-high risk to individual developers and small organizations, primarily causing credential theft and cryptocurrency wallet compromise. Financial losses can result from drained wallets or account takeovers on platforms like GitHub or Discord. The affected sectors include software development and open-source communities, as the malware targets Python package users. Data exfiltration may include API keys, corporate VPN credentials, and sensitive internal application tokens.

🛡️ Mitigation

Mitigation focuses on verifying package names before pip install, using tools like pip-audit or safety to scan dependencies, and enabling multi-factor authentication (MFA) on all critical accounts. Organizations should deploy YARA rules matching Olyx's Python script patterns (e.g., rule Olyx { strings: $dpapi = "CryptUnprotectData" condition: $dpapi }) and monitor for outbound HTTP POST traffic to known C2 IPs. Keeping browsers updated and restricting script execution via AppLocker are also recommended. Reference: Sekoia Threat Detection & Research report on Olyx (July 2024) and MITRE ATT&CK technique T1555.003 for credential theft from web browsers.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.