Security researchers have discovered three malicious PyPI packages with thousands of downloads between them being used as validation tools. To find user accounts, these packages check stolen email addresses against TikTok and Instagram APIs.
The malicious packages have been promptly removed from PyPI. These included:
- checker-SaGaF: 2,605 downloads, last updated on April 29, 2023
- steinlurks: 1,049 downloads, last updated on March 1, 2025
- sinnercore: 3,300 downloads, last updated on March 5, 2025
Security researchers from cybersec firm Socket spotted the packages and flagged all three as known malware. They have since been removed from the PyPI repositories.
All three packages work differently, but share the same goal. Checker-SaGaF exploits an internal API endpoint in TikTok’s private password recovery API to check whether or not any accounts associated with a specific email address exist on the platform. Stienlurks targets Instagram accounts and disguises its API requests as the Instagram Android app to evade detection.
Finally, sinnercore also targets Instagram, but abuses the platform’s password resetting features to both validate accounts and harass users. It also silently collects as much open-source intelligence as it can, including user information and their profile bio.
The three packages aren’t harmful by themselves, but they enable hackers to verify email addresses and accounts, a critical first step to a multi-step exploitation process. Personal information, including email addresses, can be used to dox or spam your accounts and carry out fake report attacks. They can also be used to get accounts suspended, apart from confirming target accounts before a credential stuffing or phishing attack is carried out.
Socket also reports a database of 100,000 verified email accounts for sale on a dark web forum for $300, selling each email for as low as $0.003. Suppose you’ve recently seen password change request emails you did not initiate, or believe your account might be compromised. In that case, changing your passwords as soon as possible is recommended. Additionally, developers are recommended to limit the information in error messages responding to login attempts.
In the News: 23andMe sells customer genetic data to Regeneron pharma
