Loading story…
Researchers detailed how PyInstaller-packed Python executables on both Windows and Linux can be reverse engineered to recover embedded bytecode and reconstruct malware logic. Fortinet showed that Windows samples built with Python 3.8 can be unpacked with pyinstxtractor and decompiled with uncompyle6, while Linux ELF samples may require dumping the pydata section before extraction and using Decompyle++ for Python 3.9 bytecode. In one Linux sample recovered from VirusTotal, the unpacked contents included RansomWare.pyc, indicating a ransomware payload, though some functions required bytecode disassembly or dynamic analysis because decompilation was incomplete.
Separate analysis of a PyInstaller-packed sample distributed through a Discord community recovered a multi-stage Python stealer that used Base64, junk code, XOR, AES-CBC, and compressed payloads to hide its final logic. The recovered stages ultimately decrypted and executed a Python payload associated with Creal Stealer and sent data to the attacker-controlled domain mgststudio.shop. Supporting documentation from the pyinstxtractor project also outlined the Linux ELF extraction process used to recover embedded Python files from packaged binaries.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
A researcher analyzed a PyInstaller-packed Python malware sample obtained via a Discord community, recovered multiple staged payloads, and identified the final code posting data to the attacker-controlled domain mgststudio.shop. The write-up linked the sample to Creal Stealer and described layered obfuscation including Base64, XOR, AES-CBC, and compression.
Fortinet published research showing how to unpack PyInstaller-built executables on Windows and Linux, including analysis of a real Linux ELF malware sample from VirusTotal. The unpacked sample contained RansomWare.pyc, was assessed as ransomware, and Fortinet provided detections and IOCs.
A GitHub wiki page for pyinstxtractor documented a method for extracting Linux ELF binaries, providing background relevant to later PyInstaller malware analysis workflows.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
kienmanowar.wordpress.com
Open sourcefortinet.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a new **PDFly** malware variant that uses a **custom-modified PyInstaller** executable to break common unpacking workflows and force manual reverse engineering. The sample alters PyInstaller identifiers (including a non-standard “magic cookie”) and corrupts strings so tools like *PyInstxtractor* fail to recognize the archive structure; even after adapting extraction scripts to accept the custom cookie and bypass validation checks, the recovered Python components remained **multi-layer encrypted**, with decryption logic implemented in separate bootstrap files that handle runtime extraction. Separately, an educational malware-analysis write-up detailed how to unpack **SnappyBee (Deed RAT)**, a modular backdoor previously reported in China-linked espionage activity and associated in public reporting with **Salt Typhoon / Earth Estries**. The post describes SnappyBee’s **custom packing routine** used to obscure its payload and evade static analysis, and positions the unpacking methodology as a repeatable approach for triaging similarly packed malware (including post-compromise tooling used for persistence and follow-on deployment such as **Cobalt Strike** and the **Demodex** rootkit).
Jun 29, 2026
Researchers documented several malware campaigns that used fake software and trojanized packages to deliver credential theft and remote-access payloads. On Windows, a fake *Resident Evil 9* mod from GitHub triggered a `curl | cmd` chain that deployed hidden batch, JavaScript, portable Node.js, portable Python, and an in-memory Go payload with browser theft, wallet targeting, hVNC-style control, webcam-related code, and exfiltration via Wormhole/B2 and Gofile; a separate fake AI video player installer led through Python bytecode, shellcode, and protected .NET loaders to **PureRAT**, which persisted through the `Run` key and communicated over authenticated WebSockets with `agent.sm-veo.com`. Another Windows campaign, dubbed **Operation TURB00**, used a Go loader and decoy console program to launch **Vidar** in memory, steal browser and application data, and install persistence through `agt.dll` and the `CadenceOptimizer` service running under `svchost` as `LocalSystem`. On macOS, analysts reversed a fully undetected **Atomic macOS Stealer (AMOS)** sample distributed as a signed DMG, bypassed its anti-VM checks, and recovered an AppleScript payload that stole browser data, wallet files, Telegram Desktop data, documents, and system information before exfiltrating to `95.164.53.3/contact`. In the software supply chain, a malicious PyPI package, `nhmpy 2.4.7`, masqueraded as NumPy while using a `.pth` file and an obfuscated JavaScript payload executed through Bun to harvest developer, cloud, CI/CD, registry, SSH, wallet, messaging, VPN, and AI-assistant secrets; it then spread using stolen GitHub tokens and malicious GitHub Actions workflows. Separately, a public Windows local privilege escalation exploit named **REDSUN** showed how attackers could turn standard-user access into `NT AUTHORITY\SYSTEM` by abusing a TOCTOU flaw involving NTFS and the Cloud Files API, creating a potential post-compromise path for malware already running on a host.
Jul 12, 2026
Threat researchers reported active cryptocurrency-focused malware campaigns that rely on social engineering and deceptive executables to steal funds or wallet-related secrets. One operation observed by CloudSEK targets **Discord** communities tied to gaming, gambling, and crypto streaming, where an actor tracked as **“RedLineCyber”** builds trust and privately shares Windows executables (e.g., `Pro.exe`, `peeek.exe`) pitched as streaming/security tools. After installation, the malware performs **clipboard hijacking**, monitoring for copied wallet addresses and swapping them with attacker-controlled addresses at paste time, enabling theft with minimal user-visible indicators and limited/no obvious command-and-control activity. Separately, Iru researcher **Calvin So** documented **MonetaStealer** on **macOS**, delivered as `Portfolio_Review.exe` but actually an **unsigned Mach-O** binary using a misleading `.exe` extension to exploit the assumption that Windows executables are harmless on Macs. The sample is **Python-based and bundled with PyInstaller**, with core logic hidden in a compressed `portfolio_app.pyc`, and was reported as having **zero detections on VirusTotal** at the time of analysis. MonetaStealer is designed to steal cryptocurrency wallet data along with browser secrets and **Keychain** information, and appears to be early-stage malware with indications of AI-assisted code structure.
Jun 29, 2026