The serpent’s tongue: Luring the Python out of its denCisco Talos·Jul 14, 10:00 UTC · Jul 14, 2026Malware155
New banking trojan “CarnavalHeist” targets Brazil with overlay attacksCisco Talos·May 31, 12:00 UTC · May 31, 2024Malware30
Famous Chollima deploying Python version of GolangGhost RATCisco Talos·Jun 18, 10:00 UTC · Jun 18, 2025Malware130
PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectorsCisco Talos·Apr 16, 17:52 UTC · Apr 16, 2020Malware30
UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaignCisco Talos·Jul 16, 10:00 UTC · Jul 16, 2026Malware30
Arkanix Stealer targets a variety of data, offers a MaaS referral programKaspersky Securelist·Feb 19, 11:01 UTC · Feb 19, 2026Malware30
New Tomiris tools and techniques: multiple reverse shells, Havoc, AdaptixC2Kaspersky Securelist·Nov 28, 07:00 UTC · Nov 28, 2025Malware142
A backdoor with a cryptowallet stealer inside cracked macOS softwareKaspersky Securelist·Jan 22, 08:00 UTC · Jan 22, 2024Malware42
Malicious PyPI Packages Using Compiled Python Code to Bypass DetectionThe Hacker News·Jun 3, 05:06 UTC · Jun 3, 2023Malware142
Python backdoor attacks and how to prevent themHelp Net Security·Mar 24, 00:00 UTC · Mar 24, 2020Malware142
OceanLotus suspected of distributing ZiChatBot malware via wheel packages in PyPIKaspersky Securelist·May 5, 14:33 UTC · May 5, 2026Malware42
Multi-Vector Miner+Tsunami Botnet with SSH Lateral MovementSecurity Affairs·Dec 2, 08:54 UTC · Dec 2, 2020MalwareCVE-2020-1488247
Threat Spotlight: Cyber Criminal Adoption of IPFS for Phishing, Malware CampaignsCisco Talos·Nov 9, 13:00 UTC · Nov 9, 2022Malware30
JhoneRAT: Cloud based python RAT targeting Middle Eastern countriesCisco Talos·Jan 16, 19:18 UTC · Jan 16, 2020MalwareCVE-2017-019935
From CastleLoader to CastleRAT: TAG-150 Advances Operations with MultiRecorded Future·Jun 22, 00:00 UTC · Jun 22, 2025Malware30
Mercenary mayhem: A technical analysis of Intellexa's PREDATOR spywareCisco Talos·May 25, 12:02 UTC · May 25, 2023MalwareCVE-2021-37973CVE-2021-37976CVE-2021-38000+2 CVEs60
North Korean Hackers Deploy New Malicious Python Packages in PyPI RepositoryThe Hacker News·Sep 5, 13:56 UTC · Sep 5, 2023Malware142
Python-Based PWOBot Targets European OrganizationsPalo Alto Unit 42·Jan 28, 20:32 UTC · Jan 28, 2022Malware130
Hijacked npm and Go Packages Use VS Code Tasks to Deploy Python InfostealerThe Hacker News·Jul 1, 10:25 UTC · Jul 1, 2026Malware142
Python Package Index Targeted Again By VMConnectInfosecurity Magazine·Sep 4, 17:30 UTC · Sep 4, 2023Malware42
Malicious Python Package uses Unicode to evade detectionSecurity Affairs·Mar 27, 07:05 UTC · Mar 27, 2023Malware142
Two malicious Python libraries were stealing SSH and GPG keysSecurity Affairs·Dec 4, 15:37 UTC · Dec 4, 2019Malware30
VVS Stealer, a new python malware steals Discord credentialsSecurity Affairs·Jan 5, 08:45 UTC · Jan 5, 2026Malware30
North Korea-linked APT Gleaming Pisces deliver new PondRAT backdoor via malicious Python packagesSecurity Affairs·Sep 23, 12:50 UTC · Sep 23, 2024Malware42
Experts Identify Fully-Featured Info Stealer and Trojan in Python Package on PyPIThe Hacker News·Mar 6, 07:41 UTC · Mar 6, 2023Malware42
Python-Based Adware Evolves to Install Malicious Browser ExtensionsThe Hacker News·Jun 26, 11:53 UTC · Jun 26, 2018Malware30
Are you using Python module 'SSH Decorator'? Newer versions include a backdoorSecurity Affairs·May 9, 12:05 UTC · May 9, 2018Malware42
Microsoft: Info-Stealing malware expands from Windows to macOSSecurity Affairs·Feb 4, 11:30 UTC · Feb 4, 2026Malware42
Fake Python Spellchecker Packages on PyPI Delivered Hidden Remote Access TrojanThe Hacker News·Jan 28, 12:14 UTC · Jan 28, 2026Malware42
BeaverTail and OtterCookie evolve with a new Javascript moduleCisco Talos·Oct 16, 10:00 UTC · Oct 16, 2025Malware130
Confucius Shifts from Document Stealers to Python BackdoorsInfosecurity Magazine·Oct 2, 14:45 UTC · Oct 2, 2025Malware55
SilentSync RAT Delivered via Two Malicious PyPI Packages Targeting Python DevelopersThe Hacker News·Sep 18, 11:38 UTC · Sep 18, 2025Malware142
TAG-150 Develops CastleRAT in Python and C, Expanding CastleLoader Malware OperationsThe Hacker News·Sep 6, 11:36 UTC · Sep 6, 2025Malware130
Highlighting TA866/Asylum Ambuscade Activity Since 2021Cisco Talos·Oct 23, 10:02 UTC · Oct 23, 2024Malware42
"Kekw" Malware in Python Packages Could Steal Data and Hijack CryptoInfosecurity Magazine·May 5, 16:30 UTC · May 5, 2023Malware42