Loading story…
Researchers identified PyMICROPSIA, a Python-based information-stealing Trojan linked to the AridViper threat group and tied to the broader MICROPSIA malware family. The malware targets Windows systems and supports espionage-focused capabilities including browser credential theft, screenshot capture, audio recording, USB data collection, file exfiltration, Outlook data theft, and remote command execution. It communicates with command-and-control infrastructure over HTTP POST requests using multiple URI paths and themed command names, while also downloading additional payloads for keylogging and persistence through a startup shortcut.
The attribution builds on earlier reporting around MICROPSIA and related AridViper activity, including prior campaigns using Delphi-based malware associated with Palestinian targeting themes. Researchers said PyMICROPSIA shares code overlaps, similar C2 path structures, use of RAR archives for exfiltration, themed naming conventions, and Arabic-language comments found in earlier tooling, indicating the group is evolving an established espionage platform rather than introducing an entirely new malware lineage. Active-development indicators, including incomplete or unreachable code branches, suggest the toolset was still being refined as it was deployed.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Unit 42 reported a new Python-based information-stealing Trojan named PyMICROPSIA, describing its espionage capabilities, supporting payloads, and ties to the existing MICROPSIA malware family. The researchers attributed the malware to AridViper based on code overlaps, C2 similarities, exfiltration methods, naming conventions, and Arabic-language comments.
Radware published a blog post analyzing MICROPSIA malware, adding public reporting on the malware family later linked to PyMICROPSIA and AridViper.
Cisco Talos published research on a Delphi-based malware campaign associated with targeting Palestine, documenting earlier activity tied to what later reporting connects with the MICROPSIA/AridViper cluster.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 48 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
blog.radware.com
Open sourceunit42.paloaltonetworks.com
Open sourceblog.talosintelligence.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple cyber-espionage operations targeted الفلسطينيين, activists, and organizations in the Palestinian territories with politically themed phishing lures and fake documents that delivered custom backdoors including **Micropsia**, **Spark**, **Pierogi**, and **Scote**. Reporting from Cisco Talos, Cybereason, and Palo Alto Networks links the activity to long-running Middle East-focused threat actors **Arid Viper** and **MoleRATs** (also known as the Gaza Cybergang), which repeatedly used Arabic-language decoys tied to regional politics, social-engineering archives hosted on services such as Dropbox and Egnyte, malicious RTF and Word files, and self-extracting executables to infect victims. The malware families provided persistent remote access and espionage capabilities including host reconnaissance, command execution, keylogging, screenshot capture, audio recording, file transfer, and HTTP-based command-and-control. Researchers said the operators also used evasion and targeting checks such as security-product discovery, Arabic language or keyboard validation, packers, and abuse of third-party platforms including Pastebin, Google+, and URL shorteners to hide infrastructure and retrieve C2 data. Across the campaigns, analysts observed largely consistent tradecraft over several years, indicating sustained intelligence collection against Palestinian political and civil-society targets despite repeated public exposure.
Aug 15, 2026
Palo Alto Networks Unit 42 detailed a stealth-focused intrusion toolkit built around **PyXie**, **PyXie Lite**, **Vatet**, and **Defray777**, alongside associated **Cobalt Strike** command-and-control infrastructure. The malware set supports multi-stage post-compromise activity, including host reconnaissance, credential and document theft, screenshot capture, software and registry discovery, administrative group enumeration, network configuration collection, and port scanning, indicating an operation designed to map victim environments before follow-on action. The reported artifacts show payload staging under Windows system paths and network-share locations, with numerous SHA-256 hashes, C2 IPs, domains, execution arguments, and payload paths tied to the activity. Unit 42 said **PyXie Lite** was configured to collect files matching sensitive business, infrastructure, financial, and cryptocurrency-related patterns, while **Vatet** samples used masquerading themes and embedded PDB paths referencing tools and components such as Rainmeter, Notepad++, Notepad, TetrisGame, Cobalt Strike mode, and ransomware, suggesting a mature ecosystem capable of broad discovery, exfiltration, and likely follow-on ransomware or destructive operations.
Aug 14, 2026
Researchers documented several **multi-stage malware campaigns** that used phishing lures, fake software updates, and DLL sideloading to deploy credential theft and remote access payloads. In one June 2026 intrusion targeting a small number of German financial institutions, a spear-phishing email posing as an urgent VPN update delivered a 7-Zip self-extracting archive that dropped a signed copy of **Radmin VPN** alongside a trojanized `Qt5Core.dll`, launching **HijackLoader** and ultimately **Vidar v2.1** through process hollowing into a signed `dBpoweramp` binary. A parallel chain used Opera sideloading to install **SnappyClient RAT**. Separate reporting also described a targeted Spanish-language phishing lure that delivered a password-protected archive containing a .NET loader and a byte-reversed DLL payload, as well as a fake browser update chain that used a signed **G DATA AntiVirus** binary to sideload **PlugX** linked to suspected **Mustang Panda** activity. Across the cases, the malware families showed strong emphasis on **credential theft, stealth, and layered execution**. Vidar samples were observed harvesting browser passwords, cookies, screenshots, FileZilla and WinSCP data, and cryptocurrency wallet information, while also bypassing Chromium App-Bound Encryption by launching legitimate Chrome and Edge instances with specific flags and using dead-drop resolvers such as **Steam** and **Telegram** to locate command-and-control servers. The PlugX implant used multiple decoding and encryption layers, manual PE mapping, registry-based persistence, and WinHTTP communications to `fruitbrat[.]com:443`, while another credential-stealing sample tied in open sources to **RedFoxtrot** targeted Firefox and Internet Explorer data and used proxy-aware HTTP communications with hardcoded infrastructure. The reporting highlights continued attacker reliance on signed binaries, staged loaders, and obfuscated payload handling to evade detection while stealing credentials and enabling follow-on access.
Jul 12, 2026