Get the latest tech news

Malicious PyPI Package 'Pytoileur' Targets Windows and Leverages Stack Overflow for Distribution

Another day, another PyPI malware package. But this one has a new way to (try to) sneak into your computer.

In its latest adventure in malware, Sonatype, a software supply chain security company, discovered Pytoileur, a package designed to download and install trojanized Windows binaries capable of surveillance, achieving persistence and stealing cryptocurrency—you know, the usual. It described itself as a “Cool package” in its metadata, and its webpage description touted it as an “API Management tool written in Python.” Its malware components include trojan Windows binaries that can monitor user activity, capture sensitive information and exfiltrate data to remote servers controlled by the attackers. Pytoileurs’s chief poison is a binary that goes by the generic name “main.exe.” This program attempts to exfiltrate user profiles and data saved in common web browsers (Google Chrome, Brave, Firefox, etc.).

Get the Android app