Loading story…
Researchers reported a new PDFly malware variant that uses a custom-modified PyInstaller executable to break common unpacking workflows and force manual reverse engineering. The sample alters PyInstaller identifiers (including a non-standard “magic cookie”) and corrupts strings so tools like PyInstxtractor fail to recognize the archive structure; even after adapting extraction scripts to accept the custom cookie and bypass validation checks, the recovered Python components remained multi-layer encrypted, with decryption logic implemented in separate bootstrap files that handle runtime extraction.
Separately, an educational malware-analysis write-up detailed how to unpack SnappyBee (Deed RAT), a modular backdoor previously reported in China-linked espionage activity and associated in public reporting with Salt Typhoon / Earth Estries. The post describes SnappyBee’s custom packing routine used to obscure its payload and evade static analysis, and positions the unpacking methodology as a repeatable approach for triaging similarly packed malware (including post-compromise tooling used for persistence and follow-on deployment such as Cobalt Strike and the Demodex rootkit).
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Darktrace released a technical analysis of SnappyBee (Deed RAT), describing its DLL side-loading execution chain, ARC4-based decryption, in-memory staging, and debugger-based unpacking workflow for recovering later-stage payloads.
After reverse-engineering the scheme, Samplepedia produced a more generic extractor capable of locating custom cookie structures and automatically recovering XOR keys from pyimod01_archive.pyc to decrypt future variants.
Samplepedia analysts determined the malware's decryption logic resided in separate bootstrap components and documented a multi-stage process involving XOR, zlib decompression, a second XOR, byte reversal, and unmarshaling into Python code objects.
Analysts found a related sample named PDFClick that used the same custom PyInstaller-based evasion approach, indicating active development and a wider malware evasion campaign.
Security researcher Luke Acha first publicly identified a PDFly malware variant using a modified PyInstaller executable designed to break standard extraction and analysis workflows.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Darktrace published a technical walkthrough of unpacking and analyzing **SnappyBee** (aka **Deed RAT**), a modular backdoor previously reported in China-linked espionage activity attributed to **Salt Typhoon** (aka *Earth Estries*). The write-up describes SnappyBee as typically deployed **post-compromise** to establish persistence and enable follow-on tooling (including **Cobalt Strike** and the **Demodex** rootkit), and highlights its use of a **custom packing routine** intended to obscure the payload and hinder static analysis. Zscaler ThreatLabz detailed **GuLoader**’s evolving **obfuscation** methods designed to evade detection and frustrate reverse engineering. Techniques described include **polymorphic “dynamic constant construction”** (building constants at runtime via instruction sequences like `mov`, `xor`, `add`, `sub`) and **exception-based control-flow redirection** that replaces normal `jmp` logic with deliberately triggered CPU exceptions handled by custom exception handlers (e.g., `0x80000003` `STATUS_BREAKPOINT`, `0x80000004` `STATUS_SINGLE_STEP`, `0xC0000005` `STATUS_ACCESS_VIOLATION`), complicating automated tracing and signature-based detection.
Jun 29, 2026
Researchers at Point Wild reported a malware campaign that abuses the legitimate packaging tool **PyInstaller** to disguise and deliver **XWorm RAT v7.4** inside files presented as benign software or updates. The infection chain uses obfuscation and anti-analysis techniques, including a routine identified as `_IAT_PHANTOM_FIX`, then patches **AMSI** in memory to weaken Windows scanning before unpacking an encrypted payload. The malware is then dropped into `%LOCALAPPDATA%` as the hidden system file `Win.Kernel_Svc_AJ8iOw.exe`, helping it evade user notice and endpoint defenses. Once installed, the payload connects to command-and-control infrastructure at `68.219.64.89:4444` using an **AES** key and enables a broad set of remote-access capabilities. Point Wild said XWorm can steal passwords, access files, activate webcams, launch **DDoS** attacks, and provide full remote control; researchers also observed deployment of an additional file, `afacan313131.exe`, as part of the intrusion. The findings show how attackers are combining trusted developer tools with memory patching and encrypted payload delivery to make a well-known malware family harder to detect.
Jun 29, 2026
Researchers documented several malware campaigns that used fake software and trojanized packages to deliver credential theft and remote-access payloads. On Windows, a fake *Resident Evil 9* mod from GitHub triggered a `curl | cmd` chain that deployed hidden batch, JavaScript, portable Node.js, portable Python, and an in-memory Go payload with browser theft, wallet targeting, hVNC-style control, webcam-related code, and exfiltration via Wormhole/B2 and Gofile; a separate fake AI video player installer led through Python bytecode, shellcode, and protected .NET loaders to **PureRAT**, which persisted through the `Run` key and communicated over authenticated WebSockets with `agent.sm-veo.com`. Another Windows campaign, dubbed **Operation TURB00**, used a Go loader and decoy console program to launch **Vidar** in memory, steal browser and application data, and install persistence through `agt.dll` and the `CadenceOptimizer` service running under `svchost` as `LocalSystem`. On macOS, analysts reversed a fully undetected **Atomic macOS Stealer (AMOS)** sample distributed as a signed DMG, bypassed its anti-VM checks, and recovered an AppleScript payload that stole browser data, wallet files, Telegram Desktop data, documents, and system information before exfiltrating to `95.164.53.3/contact`. In the software supply chain, a malicious PyPI package, `nhmpy 2.4.7`, masqueraded as NumPy while using a `.pth` file and an obfuscated JavaScript payload executed through Bun to harvest developer, cloud, CI/CD, registry, SSH, wallet, messaging, VPN, and AI-assistant secrets; it then spread using stolen GitHub tokens and malicious GitHub Actions workflows. Separately, a public Windows local privilege escalation exploit named **REDSUN** showed how attackers could turn standard-user access into `NT AUTHORITY\SYSTEM` by abusing a TOCTOU flaw involving NTFS and the Cloud Files API, creating a potential post-compromise path for malware already running on a host.
Jul 12, 2026