Loading malware…
WKLP is a Python-based remote access trojan with information-stealing capabilities that targets Windows systems. It has been observed targeting government organizations in the United States and France. It steals credentials, browser data, password-manager information, and sensitive files, while enabling remote command execution, deployment of additional payloads, and access to the victim’s screen, camera, microphone, and clipboard.
WKLP uses PowerShell to launch a legitimate Python runtime disguised as a Windows system process. It weakens endpoint defenses by adding Microsoft Defender exclusions, terminating security processes, and creating firewall rules masquerading as Windows Update Service rules. A watchdog mechanism restores deleted malware copies, supporting persistent access and complicating removal.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.