Loading malware…
WhirlCoil is an obfuscated Python loader used by the China-aligned threat actor TA415, which overlaps with activity tracked as APT41 and Brass Typhoon. Proofpoint observed TA415 using WhirlCoil in spear-phishing campaigns from at least September 2024 and again in July and August 2025 against U.S. government, think tank, and academic targets focused on U.S.-China relations, trade, and economic policy; earlier activity also targeted aerospace, chemicals, insurance, and manufacturing organizations. In the observed infection chain, password-protected archives hosted on services such as Zoho WorkDrive, Dropbox, and OpenDrive contained an LNK file and hidden files in a MACOS folder. The LNK executed a batch script such as logon.bat, which launched the WhirlCoil loader as update.py via a bundled pythonw.exe interpreter. Earlier variants reportedly downloaded the loader from paste sites such as Pastebin and obtained Python from the official Python website. WhirlCoil installs the VS Code CLI to %LOCALAPPDATA%\Microsoft\VSCode, checks administrative privileges via ctypes.windll.shell32.IsUserAnAdmin(), and creates scheduled-task persistence, commonly using names such as GoogleUpdate, GoogleUpdated, or MicrosoftHealthcareMonitorNode, typically configured to run every two hours and, when possible, with SYSTEM privileges. It then executes "code.exe tunnel user login --provider github --name <COMPUTERNAME>" to establish a Visual Studio Code Remote Tunnel, writes the returned verification code to output.txt, harvests system information including Windows version, locale, computer name, username, domain, and contents of multiple user directories, and exfiltrates the collected data plus the tunnel verification code via HTTP POST as base64-encoded data to free request-logging services such as requestrepo.com. With the verification code, the attacker can authenticate the VS Code Remote Tunnel and remotely access the victim filesystem and terminal for persistent backdoor access and arbitrary command execution.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The batch script executes the WhirlCoil Python loader (update.py) via pythonw.exe, which is bundled within an embedded Python package also located in the _MACOS_ folder of the archive.
The batch script executes the WhirlCoil Python loader (update.py) via pythonw.exe, which is bundled within an embedded Python package also located in the _MACOS_ folder of the archive.
15 distinct techniques documented for this family, organized by ATT&CK tactic.
A scheduled task, typically named GoogleUpdate, GoogleUpdated, or MicrosoftHealthcareMonitorNode, is created for persistence which runs the WhirlCoil Python script every two hours.
The function of the LNK file is to execute a batch script named logon.bat contained within the hidden folder and display a corrupt PDF hosted on OpenDrive to the user as a decoy document.
Following this, the script collects system information (including Windows version, locale, computer name, username, and domain) and the contents of a range of user directories.
24 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Obfuscated Python loader used to establish persistence and set up a Visual Studio Code remote tunnel for backdoor access, used by TA415 in spear-phishing campaigns.
Obfuscated Python loader used to establish persistence and set up a Visual Studio Code remote tunnel for backdoor access, used by TA415 in spear-phishing campaigns.
WhirlCoil is a Python-based loader and backdoor used to establish persistent remote access via VS Code Remote Tunnels, harvest system and user data, and exfiltrate information to attacker-controlled infrastructure. It is deployed through phishing campaigns and maintains persistence via scheduled tasks.
An obfuscated Python loader used in TA415 spear-phishing campaigns. It is executed via an LNK-and-batch-script infection chain, sets persistence through scheduled tasks, establishes a Visual Studio Code remote tunnel for persistent backdoor access, and harvests system information and user directory contents for exfiltration.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.