03-05-2025
Data-Stealing Gmail Tunnel Created By Hackers — What You Need To Know
Beware this Python threat that creates a Gmail tunnel.
Love it or loathe it, you can't ignore Google's highly popular free email platform, Gmail. With reports of sophisticated threats against users and seven-day account recovery warnings following password compromises, this is one email service that's never far from the news headlines. While many of these involve direct attacks against Gmail accounts, some are a little more, shall we say, complex in terms of the threat they pose. Such is the case with the latest report from security researchers who have uncovered Coffin-Code attackers using malicious Python packages designed to create a data-exfiltrating tunnel by way of Gmail. Here's what you need to know.
Let's start at the beginning and make it clear that the Simple Mail Transfer Protocol at the heart of this attack mechanism is not used by Gmail alone. SMTP is the de facto communication protocol used to send and receive email across the internet. It is, however, a highly trusted protocol just as Gmail is a highly trusted email provider. Trust plus trust, in this case, equals danger.
What the Socket Threat Research Team discovered, as reported by Olivia Brown, a threat analyst at Socket, is that attackers have created a bunch of malicious Python packages that use Gmail's SMTP protocol to create a tunnel that can exfiltrate data and execute attack commands. Read the full report if you want all the technical details.
Although all seven malicious packages have now been removed from the Python Package Index, the attack methodology is worth taking note of. 'Watch for unusual outbound connections, especially SMTP traffic, since attackers can use legitimate services like Gmail to steal sensitive data,' Brown warned.
I have reached out to Gmail for a statement.
