Ankura CTIX FLASH Update - May 31, 2024

Ransomware/Malware Activity

Cybercriminals Use Stack Overflow to Promote Infostealing Malware

Researchers at Sonatype have discovered a new malicious PyPi package that is being pushed by nefarious Stack Overflow users as a solution to various coding problems. Stack Overflow is a widely online forum used by developers and hobbyists ranging in expertise on nearly every technology topic. The cybercriminals behind the campaign are abusing the trust many users place on the good faith answers to their coding and engineering problems. The malicious PyPi package named "pytoileur" was only recently uploaded by attackers on May 27, 2024. The package appears to be connected to a previous malware campaign named "Cool package" based on the package's description on PyPi's repository. The package includes a file "setup.py" which contains an encoded command that is padded with spaces, effectively hiding the suspicious exec() command unless word wrap is enabled on the victim's