A malicious Python package named “fabrice” has been discovered by security researchers in the Python Package Index (PyPI). Fabrice has been available for download since 2021 and is likely a typosquat of the very popular and legitimate SSH remote server management package “fabric”. It is possible that fabrice was not flagged by the community earlier because advanced scanning tools were available only after its initial submission to PyPI. The malicious package had been downloaded over 37,000 times, and contains code scripted to steal AWS credentials using boto3, the official Python SDK for AWS. Once a boto3 session is initialized, the malicious package collects the AWS credentials associated with the session and exfiltrates the data to a VPN server. Fabrice can operate on both Windows and Linux systems. On Linux systems, it sets up a hidden directory at ‘~/.local/bin/vscode’ to store encoded shell scripts that are responsible for executing commands. On Windows, fabrice downloads a VBScript that launches a Python script (d.py) that drops a malicious executable (‘chrome.exe’) into a user’s Downloads folder. The executable schedules a Windows task to execute every fifteen (15) minutes, maintaining persistence across reboots. CTIX analysts recommend that individuals and organizations check their systems to ensure the package has not been downloaded. CTIX analysts also recommend that organizations employ AWS Identity and Access Management to limit how AWS resources can be used. CTIX analysts will continue to report on new and emerging forms of malware and associated campaigns.