Fake OSINT and GPT Utility GitHub Repos Spread PyStoreRAT Malware Payloads

According to The Hacker News, cybersecurity researchers are warning about a GitHub-based campaign that distributes a previously undocumented JavaScript-based Remote Access Trojan called PyStoreRAT via Python repositories masquerading as OSINT tools and other utilities.

Morphisec researcher Yonatan Edri told THN that PyStoreRAT is a modular, multi-stage implant capable of executing EXE, DLL, PowerShell, MSI, Python, JavaScript, and HTA modules, with the malware also deploying an information stealer named Rhadamanthys as a follow-on payload. The campaign began surfacing in mid-June 2025, with a steady stream of repositories promoted on YouTube and X, and attackers using maintenance commits in October and November to slip in the malicious payload.

The loader stub silently downloads a remote HTA file and executes it via mshta.exe, while checks for antivirus names like Falcon or Reason to tailor its execution; persistence is achieved by a scheduled task masquerading as an NVIDIA app self-update, and the final stage contacts an external server for commands.

THN notes that the threat actors use dormant or new GitHub accounts to publish these repositories, often embedding the payload in loader stubs and obscuring their intent behind “OSINT” or security-themed utilities, with some tools reportedly failing to function as advertised.