Cybersecurity experts have identified a new attack vector where threat actors are deploying malicious Python packages that exploit social media platforms’ internal APIs to validate stolen credentials.