An ongoing attack has so far delivered a cocktail of malicious wares to more than 500,000 users by abusing Bitbucket, the source code management system operated by Atlassian, researchers reported on Wednesday.

The attack, carried out by multiple holders of malicious Bitbucket accounts, distributes an array of malware that carries out a wide range of nefarious actions. Siphoning email credentials and other sensitive data, installing ransomware, stealing cryptocurrency, and surreptitiously freeloading on electricity and computing resources to mine cryptocurrency are all included. Researchers at security firm Cybereason said the ongoing attack has already generated more than 500,000 downloads, an indication that the attack may be infecting a sizable number of users.