--- title: Anatomy of a Phishing Campaign - Mike Fiedler | daily.dev description: [EuroPython 2026 - S1 on 2026-07-16] 🎤 *Anatomy of a Phishing Campaign by Mike Fiedler* 🔗... canonical: https://daily.dev/posts/anatomy-of-a-phishing-campaign---mike-fiedler-hrrmomycm twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Anatomy of a Phishing Campaign - Mike Fiedler | daily.dev og:description: [EuroPython 2026 - S1 on 2026-07-16] 🎤 *Anatomy of a Phishing Campaign by Mike Fiedler* 🔗... og:url: https://daily.dev/posts/anatomy-of-a-phishing-campaign---mike-fiedler-hrrmomycm og:image: https://api.daily.dev/og/posts/HRRmomycM.png og:image:alt: Anatomy of a Phishing Campaign - Mike Fiedler og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Anatomy of a Phishing Campaign - Mike Fiedler **[EuroPython Conference](https://daily.dev/sources/europython)** · 28 min read · 0 upvotes · 0 comments ## Summary [EuroPython 2026 - S1 on 2026-07-16] 🎤 *Anatomy of a Phishing Campaign by Mike Fiedler* 🔗 https://ep2026.europython.eu/session/anatomy-of-a-phishing-campaign 📝 Abstract: In July 2025, PyPI users received emails directing them to pypj.org—a near-perfect clone transparently proxying requests to pypi.org. Within hours, attackers compromised four accounts and uploaded malicious releases of the popular num2words package. This talk dissects the complete attack chain: how attackers harvested email addresses from public package metadata, built a transparent proxy that relayed TOTP codes in real-time, and why traditional 2FA failed while WebAuthn-based authentication stopped the attack cold. The session covers the incident response timeline, challenges getting malicious infrastructure taken down (including initial rejection of abuse reports), and defensive measures deployed afterward—including new email verification for TOTP logins from unrecognized devices. Attendees will learn exactly how modern phishing attacks work against package repositories, the critical difference between "phishable" and "phishing-resistant" 2FA, and practical steps to protect accounts and packages from the next campaign. The talk also examines the September 2025 follow-up campaign targeting pypi-mirror.org and patterns across these ongoing attacks. --- This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License: https://creativecommons.org/licenses/by-nc-sa/4.0/ ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: --- Tags: [#python](https://daily.dev/tags/python), [#conference](https://daily.dev/tags/conference) [View this post on daily.dev](https://daily.dev/posts/anatomy-of-a-phishing-campaign---mike-fiedler-hrrmomycm) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Anatomy of a Phishing Campaign - Mike Fiedler","url":"https://daily.dev/posts/anatomy-of-a-phishing-campaign---mike-fiedler-hrrmomycm","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/anatomy-of-a-phishing-campaign---mike-fiedler-hrrmomycm"},"datePublished":"2026-08-19T10:14:20.892Z","dateModified":"2026-08-19T12:02:07.402Z","description":"[EuroPython 2026 - S1 on 2026-07-16]\n🎤 *Anatomy of a Phishing Campaign by Mike Fiedler* \n🔗...","image":"https://i.ytimg.com/vi/zR_ib9m4aLU/sddefault.jpg","thumbnailUrl":"https://i.ytimg.com/vi/zR_ib9m4aLU/sddefault.jpg","isAccessibleForFree":true,"articleSection":"EuroPython Conference","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"EuroPython Conference","logo":"https://media.daily.dev/image/upload/s--qu8RO-lH--/f_auto,q_auto/v1777800764/logos/europython?_a=BAMAMiWQ0","url":"https://daily.dev/sources/europython"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/anatomy-of-a-phishing-campaign---mike-fiedler-hrrmomycm","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"python,conference","timeRequired":"PT28M","video":{"@type":"VideoObject","name":"Anatomy of a Phishing Campaign - Mike Fiedler","description":"[EuroPython 2026 - S1 on 2026-07-16]\n🎤 *Anatomy of a Phishing Campaign by Mike Fiedler* \n🔗...","thumbnailUrl":"https://i.ytimg.com/vi/zR_ib9m4aLU/sddefault.jpg","uploadDate":"2026-08-19T10:14:20.892Z","duration":"PT28M","url":"https://api.daily.dev/r/HRRmomycM","embedUrl":"https://www.youtube.com/embed/zR_ib9m4aLU"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"EuroPython Conference","item":"https://daily.dev/sources/europython"},{"@type":"ListItem","position":3,"name":"Anatomy of a Phishing Campaign - Mike Fiedler"}]} ```