https://www.bleepingcomputer.com/news/security/cybercriminals-pose-as-helpful-stack-overflow-users-to-push-malware/ BleepingComputer.com logo * * * * [ ] [Login] [Sign up] * * * * [ ] [Login] [Sign up] * News + Featured + Latest + Police seize over 100 malware loader servers, arrest four cybercriminals Police seize over 100 malware loader servers, arrest four cybercriminals + Cybercriminals pose as Cybercriminals pose as "helpful" Stack Overflow users to push malware + Check Point releases emergency fix for VPN zero-day exploited in attacks Check Point releases emergency fix for VPN zero-day exploited in attacks + Cooler Master confirms customer info stolen in data breach Cooler Master confirms customer info stolen in data breach + Microsoft: Windows 11 preview update causes taskbar crashes Microsoft: Windows 11 preview update causes taskbar crashes + Pirated Microsoft Office delivers malware cocktail on systems Pirated Microsoft Office delivers malware cocktail on systems + Data of 560 million Ticketmaster customers for sale after alleged breach Data of 560 million Ticketmaster customers for sale after alleged breach + Malware botnet bricked 600,000 routers in mysterious 2023 attack Malware botnet bricked 600,000 routers in mysterious 2023 attack * Tutorials + Latest + Popular + How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 + How to use the Windows Registry Editor How to use the Windows Registry Editor + How to backup and restore the Windows Registry How to backup and restore the Windows Registry + How to open a Windows 11 Command Prompt as Administrator How to open a Windows 11 Command Prompt as Administrator + How to start Windows in Safe Mode How to start Windows in Safe Mode + How to remove a Trojan, Virus, Worm, or other Malware How to remove a Trojan, Virus, Worm, or other Malware + How to show hidden files in Windows 7 How to show hidden files in Windows 7 + How to see hidden files in Windows How to see hidden files in Windows * Virus Removal Guides + Latest + Most Viewed + Ransomware + Remove the Theonlinesearch.com Search Redirect Remove the Theonlinesearch.com Search Redirect + Remove the Smartwebfinder.com Search Redirect Remove the Smartwebfinder.com Search Redirect + How to remove the PBlock+ adware browser extension How to remove the PBlock+ adware browser extension + Remove the Toksearches.xyz Search Redirect Remove the Toksearches.xyz Search Redirect + Remove Security Tool and SecurityTool (Uninstall Guide) Remove Security Tool and SecurityTool (Uninstall Guide) + How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo + How to remove Antivirus 2009 (Uninstall Instructions) How to remove Antivirus 2009 (Uninstall Instructions) + How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using TDSSKiller How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using TDSSKiller + Locky Ransomware Information, Help Guide, and FAQ Locky Ransomware Information, Help Guide, and FAQ + CryptoLocker Ransomware Information Guide and FAQ CryptoLocker Ransomware Information Guide and FAQ + CryptorBit and HowDecrypt Information Guide and FAQ CryptorBit and HowDecrypt Information Guide and FAQ + CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ * Downloads + Latest + Most Downloaded + Qualys BrowserCheck Qualys BrowserCheck + STOPDecrypter STOPDecrypter + AuroraDecrypter AuroraDecrypter + FilesLockerDecrypter FilesLockerDecrypter + AdwCleaner AdwCleaner + ComboFix ComboFix + RKill RKill + Junkware Removal Tool Junkware Removal Tool * Deals + Categories + eLearning eLearning + IT Certification Courses IT Certification Courses + Gear & Gadgets Gear + Gadgets + Security Security * VPNs + Popular + Best VPNs Best VPNs + How to change IP address How to change IP address + Access the dark web safely Access the dark web safely + Best VPN for YouTube Best VPN for YouTube * Forums * More + Startup Database + Uninstall Database + Glossary + Chat on Discord + Send us a Tip! + Welcome Guide * Home * News * Security * Cybercriminals pose as "helpful" Stack Overflow users to push malware * * Cybercriminals pose as "helpful" Stack Overflow users to push malware By Lawrence Abrams * May 29, 2024 * 07:22 PM * 0 Stack Overflow Cybercriminals are abusing Stack Overflow in an interesting approach to spreading malware--answering users' questions by promoting a malicious PyPi package that installs Windows information-stealing malware. Sonatype researcher Ax Sharma (and a writer at BleepingComputer) discovered this new PyPi package is part of a previously known 'Cool package' campaign, named after a string in the package's metadata, that targeted Windows users last year. This PyPi package is named 'pytoileur' and was uploaded by threat actors to the PyPi repository over the weekend, claiming it was an API management tool. Notice how the package has the "Cool package" string in the Summary metadata field, indicating it is part of this ongoing campaign. Malicious pytoileur PyPi packageMalicious pytoileur PyPi package Source: Sonatype Malicious packages like this are usually promoted using names similar to other popular packages, a process called typo-squatting. However, with this package, the threat actors took a more novel approach by answering questions on Stack Overflow and promoting the package as a solution. Stack Overflow answer promoting malicious PyPi packageStack Overflow answer promoting malicious PyPi package Source: BleepingComputer As Stack Overflow is a widely used platform for developers of all skill sets to ask and answer questions, it provides a perfect environment to spread malware disguised as programming interfaces and libraries. "We further noticed that a StackOverflow account "EstAYA G" created roughly 2 days ago is now exploiting the platform's community members seeking debugging help [1, 2, 3] by directing them to install this malicious package as a "solution" to their issue even though the "solution" is unrelated to the questions posted by developers," explained Sharma in the Sonatype report. In this case, the pytoileur package contains a 'setup.py' files that pads a base64 encoded command to execute with spaces so it is hidden unless you enable word wrap in your IDE or text file editor. Obfuscated command to execute in setup.pyObfuscated command to execute in setup.py Source: BleepingComputer When deobfuscated, this command will download an executable named 'runtime.exe' [VirusTotal] from a remote site and execute it. Deobfuscated Base64-encoded commandDeobfuscated Base64-encoded command Source: BleepingComputer This executable is actually a Python program converted into an .exe that acts as an information-stealing malware to harvest cookies, passwords, browser history, credit cards, and other data from web browsers. It also appears to search through documents for specific phrases and, if found, steal the data as well. All of this information is then sent back to the attacker, who can sell it on dark web markets or use it to breach further accounts owned by the victim. While malicious PyPi packages and information-stealers are nothing new, the cybercriminals' strategy to pose as helpful contributors on Stack Overflow is an interesting approach as it allows them to exploit the trust and authority of the site in the coding community. This approach serves as a reminder of the constantly changing tactics of cybercriminals and, unfortunately, illustrates why you can never blindly trust what someone shares online. Instead, developers must verify the source of all packages they add to their projects, and even if it feels trustworthy, check the code (with word wrap enabled) for unusual or obfuscated commands that will be executed. Related Articles: PyPi package backdoors Macs using the Sliver pen-testing suite Telegram fixes Windows app zero-day used to launch Python scripts Give Dad a palm-sized Windows desktop with $55 off the ECS LIVA Microsoft: Windows 24H2 will remove Cortana and WordPad apps New ShrinkLocker ransomware uses BitLocker to encrypt your files * Information-stealing malware * Packages * PyPI * Python * Stack OverFlow * Windows * * * * * Lawrence Abrams Lawrence Abrams is the owner and Editor in Chief of BleepingComputer.com. Lawrence's area of expertise includes Windows, malware removal, and computer forensics. Lawrence Abrams is a co-author of the Winternals Defragmentation, Recovery, and Administration Field Guide and the technical editor for Rootkits for Dummies. * Previous Article * Next Article Post a Comment Community Rules You need to login in order to post a comment [Login] Not a member yet? Register Now You may also like: [INS::INS] Mandiant mWise Conference 2024 Popular Stories * Android Over 90 malicious Android apps with 5.5M installs found on Google Play * Fortinet Exploit released for maximum severity Fortinet RCE bug, patch now Follow us: * * * * * Main Sections * News * VPN Buyer Guides * SysAdmin Software Guides * Downloads * Virus Removal Guides * Tutorials * Startup Database * Uninstall Database * Glossary Community * Forums * Forum Rules * Chat Useful Resources * Welcome Guide * Sitemap Company * About BleepingComputer * Contact Us * Send us a Tip! * Advertising * Write for BleepingComputer * Social & Feeds * Changelog Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2024 Bleeping Computer^(r) LLC - All Rights Reserved Login Username [ ] Password [ ] [*] Remember Me [ ] Sign in anonymously [Login] Sign in with Twitter button Sign in with Twitter --------------------------------------------------------------------- Not a member yet? Register Now Reporter Help us understand the problem. What is going on with this comment? * ( )Spam * ( )Abusive or Harmful * ( )Inappropriate content * ( )Strong language * ( )Other [ ] * [ ] Read our posting guidelinese to learn what content is prohibited. Submitting... SUBMIT