Warning: New Malicious Python Package “Pytoileur” Targets Cryptocurrency – Avoid Downloading!
Cybersecurity researchers have discovered a malicious Python package, pytoileur, in the PyPI repository, designed to facilitate cryptocurrency theft. The package, downloaded 316 times, executes malicious code upon installation, retrieving a Windows binary to deploy spyware and steal data. This incident highlights the increasing risk of supply chain attacks targeting open-source ecosystems.
Hot Take:
PyPI? More like Py-Piecing your data away! Looks like crypto thieves have found a new way to cash in on developers’ naivety. Time to update that Pipfile with some extra caution, folks!
Key Points:
- New malicious Python package named “pytoileur” found in PyPI repository.
- Downloaded 316 times before being yanked and reinstated with identical functionality.
- Malicious code embedded in setup.py script executes Base64-encoded payload.
- Binary “Runtime.exe” retrieved and run via PowerShell and VBScript commands.
- Linked to prior malicious campaigns involving bogus Python packages like Pystob and Pywool.
Already a member? Log in here