Cybercriminals Abuse Stack Overflow to Promote Malicious Python Package

Researchers found a malicious Python package on PyPI named 'pytoileur' that runs a Base64-encoded payload from setup.py to fetch and execute a Windows binary (Runtime.exe), which establishes persistence and deploys spyware and a cryptocurrency stealer; the package was promoted via a fake Stack Overflow account and appears linked to previous bogus Python package campaigns, underscoring supply-chain abuse in open-source ecosystems.