Cybercriminals Exploit Stack Overflow to Spread Malicious PyPi Package

Cybercriminals Exploit Stack Overflow to Spread Malicious PyPi Package

Cybercriminals are leveraging Stack Overflow to promote a malicious PyPi package named ‘pytoileur,’ which installs Windows information-stealing malware. Discovered by Sonatype researcher Ax Sharma, this package is part of the ‘Cool package’ campaign, previously targeting Windows users.

Malicious pytoileur PyPi package
Source: Sonatype

The threat actors create accounts on Stack Overflow to answer questions, directing users to install this malicious package as a solution to their coding issues.

Stack Overflow answer promoting malicious PyPi package
Source: BleepingComputer

Package Details and Distribution Method

The ‘pytoileur’ package, uploaded to the PyPi repository, is presented as an API management tool. However, it includes a ‘setup.py’ file with a hidden base64 encoded command that downloads and executes a malware-laden executable named ‘runtime.exe.’ This executable is a Python program converted into an .exe file designed to steal cookies, passwords, browser history, credit card information, and more from web browsers. The stolen data is sent back to the attackers, who can then sell it on dark web markets or use it for further breaches.

Obfuscated command to execute in setup.py
Source: BleepingComputer