PyStoreRAT Uncovered: Fileless RAT Hides in Fake GitHub Repos to Launch Invisible Attacks on Developers

Morhisec Threat Labs has uncovered PyStoreRAT, a fileless Remote Access Trojan that hides in seemingly legitimate Python projects on GitHub to launch invisible attacks on developers and OSINT practitioners. Active since mid-2025, the campaign lures victims with polished tools such as “Spyder OSINT,” “HacxGPT,” or “VulnWatchDog,” which mask a brief loader that downloads a remote HTA file and executes it via mshta.exe.

According to Morphisec Threat Labs, the RAT is modular and multi-stage, capable of delivering payload formats including EXE, DLL, PowerShell, MSI, Python, JavaScript and HTA modules, and it has been observed delivering the Rhadamanthys information stealer in recent attacks. The malware actively scans for security tools and evasion logic targets CrowdStrike Falcon and other antivirus products such as ReasonLabs, modifying its execution to hinder detection.

To persist, it creates a Windows Scheduled Task masquerading as a routine driver update, described as NVIDIA App SelfUpdate_[GUID], configured to run every 10 minutes or on login. Russian-language artefacts and coding patterns point to a likely Eastern European origin, according to the report.