はじめにこんにちは。PKSHA Technology でソフトウェアエンジニアをしている山本です。2026 年 8 月 22 日に広島で開催された PyCon JP 2026 にて、「AI 時代、配布する Python コードをどう守るか: 難読化の実験と判断軸」というタイトルで発表しました。本記事は、その発表内容をもとに、発表時間の都合で触れられなかった内容も加えて文章にまとめ直したものです。

In the summer of 2026, Invoke RE began seeing the Efimer loader delivering a Pyarmor infection chain leading to a JavaScript clipper variant. We used the Frida dynamic instrumentation framework to bre...

YouTube video by Invoke RE

TWINLOOT uses SharePoint, Teams TURN, and headless Edge for C2, steals Windows credentials, and opens SOCKS5 access into victim networks.

Cybersecurity researchers have disclosed details of a previously undocumented Python implant framework dubbed TWINLOOT. "TWINLOOT is a modular, PyArmor-hardened Python implant designed to operate its entire command-and-control infrastructure inside trusted Microsoft services," Ontinue said in a technical report shared with The Hacker News. "Tasking flows through SharePoint Online file

Curate Feeds | Make Collections | Customize Email Briefs

Cybersecurity researchers have disclosed details of a previously undocumented Python implant framework dubbed TWINLOOT. "TWINLOOT is a modular, PyArmor-hardened Python implant designed to operate its entire command-and-control infrastructure inside trusted Microsoft services," Ontinue said in a technical report shared with The Hacker News. "Tasking flows through SharePoint Online file

Cybersecurity researchers have disclosed details of a new Python-based information stealer called VVS Stealer (also styled as VVS $tealer) that's capable of harvesting Discord credentials and tokens. The stealer is said to have been on sale on Telegram as far back as April 2025, according to a report from Palo Alto Networks Unit 42. "VVS stealer's code is obfuscated by Pyarmor," researchers

A new VVS stealer malware is targeting Discord accounts through obfuscated Python code, raising concerns about credential theft and account compromise

Check out dashingsoft/pyarmor on GitHub

Shield Python code with Pyarmor: obfuscate, encrypt & license in one click.

Attackers compromised the official JDownloader website and replaced selected download links with trojanized installers that delivered a Python bot, an r77 rootkit stager, and a WDAC policy designed to disable security tools. The campaign used dead-drop resolvers, DGA fallback domains, and encrypted C2 communications to maintain control, while affecting users who downloaded fresh installers during the compromise window. #JDownloader #r77 #PyArmor #WDAC

🔥Breaking Pyarmor 9 with Frida🔥 | Streaming software and game development.

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter VVS Discord Stealer Using Pyarmor for Obfuscation and Detection Evasion   A Broken System Fueling Botnets Malicious NPM Packages Deliver NodeCordRAT     Boto-Cor-de-Rosa campaign reveals Astaroth WhatsApp-based worm activity in Brazil CNCERT: Risk Warning Regarding […]

Cybersecurity researchers have disclosed details of a new Python-based information stealer called VVS Stealer (also styled as VVS $tealer) that's capable of harvesting Discord credentials and tokens. The stealer is said to have been on sale on Telegram as far back as April 2025, according to a report from Palo Alto Networks Unit 42. "VVS stealer's code is obfuscated by Pyarmor," researchers