Cybercriminals are abusing Stack Overflow in an interesting approach to spreading malware-answering users' questions by promoting a malicious PyPi package that installs Windows information-stealing malware.
Sonatype researcher Ax Sharma discovered this new PyPi package is part of a previously known 'Cool package' campaign, named after a string in the package's metadata, that targeted Windows users last year.
This PyPi package is named 'pytoileur' and was uploaded by threat actors to the PyPi repository over the weekend, claiming it was an API management tool.
Malicious packages like this are usually promoted using names similar to other popular packages, a process called typo-squatting.
With this package, the threat actors took a more novel approach by answering questions on Stack Overflow and promoting the package as a solution.
As Stack Overflow is a widely used platform for developers of all skill sets to ask and answer questions, it provides a perfect environment to spread malware disguised as programming interfaces and libraries.
In this case, the pytoileur package contains a 'setup.
Py' files that pads a base64 encoded command to execute with spaces so it is hidden unless you enable word wrap in your IDE or text file editor.
When deobfuscated, this command will download an executable named 'runtime.
Exe' [VirusTotal] from a remote site and execute it.
This executable is actually a Python program converted into an.
Exe that acts as an information-stealing malware to harvest cookies, passwords, browser history, credit cards, and other data from web browsers.
It also appears to search through documents for specific phrases and, if found, steal the data as well.
While malicious PyPi packages and information-stealers are nothing new, the cybercriminals' strategy to pose as helpful contributors on Stack Overflow is an interesting approach as it allows them to exploit the trust and authority of the site in the coding community.
This approach serves as a reminder of the constantly changing tactics of cybercriminals and illustrates why you can never blindly trust what someone shares online.
Instead, developers must verify the source of all packages they add to their projects, and even if it feels trustworthy, check the code for unusual or obfuscated commands that will be executed.
PyPi package backdoors Macs using the Sliver pen-testing suite.
Telegram fixes Windows app zero-day used to launch Python scripts.
Microsoft: Windows 24H2 will remove Cortana and WordPad apps.
New ShrinkLocker ransomware uses BitLocker to encrypt your files.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Wed, 29 May 2024 23:25:05 +0000