Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
Malware

PyStoreRAT

PyStoreRAT is a previously undocumented, modular, multi-stage Remote Access Trojan/backdoor (JavaScript/HTA-based) delivered via a GitHub supply-chain style campaign. The operation abuses GitHub trust signals by reactivating long-dormant accounts and publishing polished, likely AI-generated repositories masquerading as legitimate utilities (e.g., OSINT tools, security-themed tools, DeFi/crypto bots, GPT/AI wrappers). After the repositories gain traction (including appearing in trending lists and via artificially inflated stars/forks), attackers introduce “maintenance” commits that add a loader/backdoor component.

Infection/execution chain observed in reporting includes Python/JavaScript loader stubs embedded in the repositories that download and execute a remote HTA payload via mshta.exe, leading to PyStoreRAT execution. PyStoreRAT is designed for long-term persistence and data theft, performs extensive system profiling (including admin-privilege checks), and supports a broad plugin/module execution surface: EXE, DLL, PowerShell, MSI, Python, JavaScript, and HTA modules (including in-memory JavaScript execution). It can download and execute additional payloads; a documented follow-on payload is the Rhadamanthys information stealer, used to exfiltrate sensitive information. PyStoreRAT has also been reported to scan for cryptocurrency wallet files (including Ledger Live, Trezor, Exodus, Atomic, Guarda, BitBox02).

Evasion/adaptation features described include environment checks for specific security products (notably CrowdStrike Falcon and Reason/ReasonLabs, also referenced as CyberReason/ReasonLabs) and altering execution/launch paths when detected. Persistence has been reported via scheduled tasks disguised as NVIDIA application self-updates. Lateral/propagation capability via removable drives (USB) is also described.

Command-and-control is characterized as resilient, using a rotating/circular set of nodes to enable rapid updates and complicate takedowns. Russian-language artifacts/strings in the codebase have been noted, suggesting a possible Eastern European/Russian linkage, but no definitive attribution is provided in the content. Targeting is described as focused on developers as well as IT administrators, cybersecurity professionals/analysts, and OSINT researchers.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

MITRE ATT&CK

Techniques & procedures

1 distinct technique documented for this family, organized by ATT&CK tactic.

Stealth

1 technique
T1218.005MshtaEvidence1

"PyStoreRAT... downloading a remote HTA file and executing"; "JS#SMUGGLER... HTA"; "Water Saci... uses HTA files"

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping1

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.