Fake Software Lures Deliver Multi-Stage Stealers Across Windows, macOS, and PyPI

Researchers documented several malware campaigns that used fake software and trojanized packages to deliver credential theft and remote-access payloads. On Windows, a fake Resident Evil 9 mod from GitHub triggered a curl | cmd chain that deployed hidden batch, JavaScript, portable Node.js, portable Python, and an in-memory Go payload with browser theft, wallet targeting, hVNC-style control, webcam-related code, and exfiltration via Wormhole/B2 and Gofile; a separate fake AI video player installer led through Python bytecode, shellcode, and protected .NET loaders to PureRAT, which persisted through the Run key and communicated over authenticated WebSockets with agent.sm-veo.com. Another Windows campaign, dubbed Operation TURB00, used a Go loader and decoy console program to launch Vidar in memory, steal browser and application data, and install persistence through agt.dll and the CadenceOptimizer service running under svchost as LocalSystem.

On macOS, analysts reversed a fully undetected Atomic macOS Stealer (AMOS) sample distributed as a signed DMG, bypassed its anti-VM checks, and recovered an AppleScript payload that stole browser data, wallet files, Telegram Desktop data, documents, and system information before exfiltrating to 95.164.53.3/contact. In the software supply chain, a malicious PyPI package, nhmpy 2.4.7, masqueraded as NumPy while using a .pth file and an obfuscated JavaScript payload executed through Bun to harvest developer, cloud, CI/CD, registry, SSH, wallet, messaging, VPN, and AI-assistant secrets; it then spread using stolen GitHub tokens and malicious GitHub Actions workflows. Separately, a public Windows local privilege escalation exploit named REDSUN showed how attackers could turn standard-user access into NT AUTHORITY\SYSTEM by abusing a TOCTOU flaw involving NTFS and the Cloud Files API, creating a potential post-compromise path for malware already running on a host.