JFrog Warns of Malicious Crypto Trading Package Targeting MEXC Exchange

The JFrog Security Research team has issued a warning about a malicious package targeting crypto futures trading on the MEXC exchange. The package, named “ccxt-mexc-futures,” is designed to steal funds and leak trading credentials by redirecting user trading requests to a malicious server. The team published a report on April 15, 2025, detailing the phishing scheme, which uses the legitimate Cryptocurrency Exchange Trading (CCXT) library to deceive users.

The malicious party sets up a domain that closely resembles the legitimate MEXC domain, making it easy for users to mistake the fake site for the real one. Once a victim falls for the trap, attackers can hijack all crypto and sensitive information contained in the trading request. This includes stealing Application Programming Interface (API) keys and secrets, which can compromise crypto trading accounts.

The researchers noted that the use of obfuscation techniques and a fake MEXC website demonstrates the sophistication of this phishing campaign. The fake website is even promoted on social media platforms like Facebook, increasing its reach and potential for deception.

The ccxt-mexc-futures package claims to extend the crypto trading capabilities via the CryptoCurrency eXchange Trading (ccxt) PyPI package, a legitimate and popular crypto trading Python package that supports trading on many exchanges, including MEXC. However, the attackers claim that their malicious package extends the legitimate CCXT package to support “futures” trade on MEXC. In reality, the malicious package overrides three relevant functions: describe, sign, and prepare_request_headers, to achieve its goals.

The MEXC interface in CCXT defines a wide set of APIs to support different types of trading. The attackers targeted two of these APIs: contract_private_post_order_submit and contract_private_post_order_cancel. Once the malicious ccxt-mexc-futures package overrides these two APIs, it adds a third one, spot4_private_post_order_place. Users create, place, or cancel trading orders through these APIs, which pose as the legitimate APIs of the CCXT library. Every time a user utilizes these entries, instead of using the CCXT-defined entries, they will use the attacker’s entries, specifying futures trading in the request.

The attackers also made it so that a “BadRequest” response will change into an “OrderFilled” response, making users believe the order went through. Additionally, as the malicious package overrides the sign function, if a user tries to communicate with MEXC using the package, the requests will go to the fake domain. This also means sending the user token in the request header to the attackers. If the user token is not supplied, the package will request the user to add it before making an order. If it is not a future-related entry, the package directs the flow to the original MEXC exchange implementation of the CCXT package.

The researchers discovered two versions of the malicious package, each using different methods to hide and run arbitrary code on the victim's computer. Both methods are common ways for attackers to hide and run malicious payloads. In response to this threat, JFrog has added the malicious Python packages to JFrog Xray to enable users to detect them immediately.