Online developer community Stack Overflow was leveraged to facilitate the distribution of a malicious Python Package Index package containing cryptocurrency-stealing malware, reports The Hacker News.
Attackers used the Stack Overflow account "EstAYA G" to lure the platform's users to download the malicious "pytoileur" package, which contains code enabling the execution of a Base64-encoded payload that fetches a binary, a report from Sonatype revealed. Such a binary not only ensures persistence but also allows further compromise with cryptocurrency stealer and spyware deployment, according to researchers.
Even though Stack Overflow has already acted to remove the malicious content from its platform, the incident has been noted by researchers to be a significant global threat to developers.
"Stack Overflow's compromise is especially concerning given the large number of novice developers it has, who are still learning, asking questions, and may fall for malicious advice," said Sonatype.
