PyStoreRAT malware found on GitHub

PyStoreRAT malware found on GitHub, quote as software development tool

When it comes to Repository, which is a popular source for developers, it can't escape GitHub, which, in addition to being a popular Repo, is also a community source or community of developers, but this is also a huge gathering of hackers and malware.

According to a report by the Siliconangle website, Morphisec, an expert in the development of endpoint security solutions, has detected malware of the type that remotely controls the victim's machine, or a new RAT, called "PyStoreRAT," that has impersonated software developers through Repo on GitHub, with the goal of controlling and stealing secret data on the victim's machine. The deception is consistent, because on Repo there are many reliable-looking files, such as README that are carefully written, graphic images that are also created. Beautiful AI (Artificial Intelligence or Artificial Intelligence) and function simulator to tempt the victim to execute the code of the dialer malware.

After the code is processed, it will download and run the HTML application file via mshta.exe to prevent the detection system from being captured on the machine compared to the traditional method of running the installation on the hard disk. After running successfully, the malware will start to collect system information such as the name of the machine, the active operating system, the installed security application, and the current level of access to the system before registering the data with the C2 or Command and Control server.

The research team also found that the malware also has the ability to evade a lot of detection, whether it is the use of handshake or handshake as a Session, with the use of a unique Token that is difficult to detect. Not only that, the malware has the ability to evade "Logic," the detection of famous enterprise cybersecurity tools like CrowdStrike Falcon and other famous tools by changing the Path for running, or Execution Path immediately when it is suspected that it is being watched by such group tools.

Malware also has the ability to endure within the victim's system by creating a task schedule under the name "NVIDIA App SelfUpdate" to deceive it as a task for updating graphics software. This task runs every 10 minutes or every time the user logs into the system to guarantee that malware will run on the system at all times despite the reboot.

Malware is also available in the Module system, allowing for feature downloads and new capabilities from servers and the ability to run with a variety of file formats - DLL files, MSI installations, PowerShell scripts, Python Archive files and HTA (HTML Application) files mentioned above.

Most importantly, malware can amplify the Lateral Movement by embedding itself into a USB drive by replacing the original file inside the drive as a malware shortcut file. It will run itself before running the file that the user wants to open. The malware can spread quickly within the organization.

# Welcome 2026 # Take care of yourself # Open budget # Includes IT matters # Trending