Humanitarian Aid Lures Deliver GitHub-Hosted Python Infostealer

Researchers reported an active cyberespionage campaign dubbed Operation HumanitarianBait that uses Russian-language humanitarian aid request themes to lure victims into opening a malicious .lnk file packaged inside a .rar archive. The shortcut launches PowerShell to decode obfuscated content, opens a decoy humanitarian aid PDF to distract the user, and silently installs a fileless, PE-less Python implant from GitHub Releases into a fake WindowsHelper directory under %APPDATA%. The payload is protected with PyArmor v9.2 Pro, helping it evade scrutiny while blending into legitimate developer traffic.

Once installed, the malware establishes persistence through VBScript launchers and a recurring Windows Scheduled Task, then conducts broad surveillance and theft. Reported capabilities include browser credential and cookie theft, keylogging, clipboard and screenshot capture, file theft, and Telegram session theft, with optional covert remote access through RustDesk or AnyDesk. Stolen data is exfiltrated to a live custom Flask-based command-and-control server at 159.198.41[.]140 on a Namecheap VPS, and researchers said the Russian-language lures suggest the operation is aimed at Russian-speaking individuals or organizations, including those tied to aid distribution, civil administration, or government functions.