Python-Based Infostealer Masked as PDF Targets Browser Credentials

Overview of the Python-Based Infostealer Campaign

A recent analysis by the SANS Internet Storm Center has identified a malicious campaign distributing a Python-based infostealer. The malware is typically delivered within a compressed archive named attachment.zip, which contains a single executable file disguised with a double extension: Report.pdf.exe. This classic Phishing tactic exploits the default Windows configuration that hides known file extensions, leading unsuspecting users to believe they are opening a standard PDF document.

Upon execution, the malware initiates a comprehensive data collection routine targeting a wide array of sensitive information. This includes credentials stored in web browsers, session tokens for communication platforms, and private keys for cryptocurrency wallets. The use of Python for such malware has become increasingly common due to the ease of development and the availability of libraries that simplify the process of interacting with system APIs and network protocols.

Technical Analysis: From PyInstaller to Data Exfiltration

The malware is a PE32 executable compiled using PyInstaller, a popular tool that bundles Python scripts and their dependencies into a single standalone file. This approach allows the attacker to execute Python code on systems without a pre-installed Python interpreter. When the executable runs, it unpacks the Python environment and the core malicious script into a temporary directory before starting the execution flow.

PyInstaller malware analysis techniques

When conducting PyInstaller malware analysis techniques, responders should prioritize the extraction of the underlying compiled Python bytecode (PYC files). Tools like pyinstxtractor can be used to decompose the executable, revealing the original script logic. In this specific case, the malware relies on hardcoded strings and environment variables to coordinate its activity. The script logic follows a linear path: system reconnaissance, data harvesting, and exfiltration via a C2 channel.

How to detect Python infostealer execution

To identify this threat in a corporate environment, defenders must understand how to detect Python infostealer execution. One primary indicator is the creation of temporary folders in the %TEMP% directory with a prefix like _MEIXXXXX, which is characteristic of PyInstaller’s unpacking process. Furthermore, EDR solutions should be configured to flag or block executables that exhibit double extensions or those that are unsigned and originate from the Downloads or Temp directories.

Analyzing the exfiltration mechanism via Discord webhooks

A critical component of this malware’s lifecycle is the use of legitimate services for malicious purposes. While analyzing the exfiltration mechanism via Discord webhooks, researchers found that the malware bundles collected data into JSON or multipart form data and sends it to a hardcoded Discord URL. By leveraging Discord’s infrastructure, the attacker evades traditional firewall rules that might block known malicious domains, as many organizations allow traffic to Discord for legitimate business or social communication.

Targeted Applications and Stolen Data

The infostealer specifically targets the following categories of data and applications:

• Web Browsers: It attempts to extract saved passwords, cookies, and autofill data from Google Chrome, Brave, Opera, and Microsoft Edge.
• Communication Platforms: The malware scans for session tokens and configuration files for Discord and Telegram, which can be used for account takeover without requiring the user’s password or multi-factor authentication (MFA).
• Gaming and Infrastructure: Credentials for Steam and NordVPN are targeted, potentially for resale on underground forums.
• Cryptocurrency Wallets: The script specifically searches for directories associated with browser-based wallets like MetaMask and Atomic Wallet, aiming to steal seed phrases and private keys.

Recommendations and Mitigation Strategies

To defend against this and similar infostealers, organizations should adopt a multi-layered security approach. Monitoring for IoC related to unusual outbound POST requests to discord.com/api/webhooks/ is a high-fidelity method for detecting active infections. If your organization does not require Discord for business operations, the domain should be restricted at the perimeter.

Additionally, SOC teams should implement the following controls:

1. User Training: Educate staff on the risks of opening unexpected ZIP attachments and the dangers of double-extension files.
2. Application Control: Use policies to prevent the execution of unsigned scripts or binaries from the %APPDATA% and %TEMP% directories.
3. Network Segmentation: Ensure that workstations cannot communicate directly with external webhooks without passing through a proxy that performs deep packet inspection.