Security experts recommend developers implement strict code execution policies, employ isolated development environments, and exercise caution when running code from external sources, even when it appears to come from legitimate coding platforms or professional contacts. A sophisticated threat actor group dubbed “Slow Pisces” has emerged as a significant threat to software developers, employing deceptive coding challenges as an initial attack vector to distribute Python-based malware. Their analysis revealed that the threat actors demonstrate advanced knowledge of software development workflows and are likely targeting intellectual property and access to development environments rather than immediate financial gain. The malware also implements a delayed execution strategy that researchers have dubbed “slow burn” – where malicious activities only trigger after prolonged observation of the victim’s development patterns. The campaign specifically targets developers through professional networking sites, coding forums, and development platforms with seemingly innocuous programming puzzles that conceal malicious payloads. These messages contain links to GitHub repositories or development platforms hosting what appear to be legitimate Python coding challenges. Palo Alto Networks researchers identified the campaign after investigating multiple incidents affecting software development teams at financial technology companies. Organizations affected by these attacks have reported intellectual property theft, unauthorized access to development environments, and in some cases, subsequent ransomware incidents. The malware component, named ‘PySlowDrop’ by researchers, utilizes sophisticated obfuscation techniques and leverages legitimate Python libraries to evade detection. The attackers operate using a multi-stage infection strategy that begins with personalized messages to developers offering participation in coding competitions or collaborative problem-solving exercises.
This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 14 Apr 2025 18:35:13 +0000