Daily Edition · Page 11

THE DAILY INDEX

Technology, AI, software, security, crypto and business

Repositories, courses and useful tools

Resources & Tools

FAKE OSINT AND GPT UTILITY GITHUB REPOS SPREAD PYSTORERAT MALWARE PAYLOADS

A campaign attributed to likely Eastern European threat actors is distributing PyStoreRAT malware through GitHub repositories disguised as OSINT tools, GPT wrappers, and DeFi bots, using artificially inflated star counts and social media promotion to build credibility. The modular JavaScript-based RAT executes via mshta.exe, scans for cryptocurrency wallets, evades detection by CrowdStrike and Cybereason, and delivers the Rhadamanthys infostealer as a secondary payload. Security teams should audit dependencies from trending GitHub repositories, monitor for scheduled tasks masquerading as NVIDIA updates, and deploy endpoint detection and response solutions capable of identifying mshta.exe activity and JavaScript-based payloads to strengthen defenses against PyStoreRAT.

TLDR IndexPage 11