You can just reverse engineer the .pyd file when you encounter malware obfuscated with PyArmor? Sure, okay, that simplifies things.
July 19, 2026 at 12:47 AM
You can just reverse engineer the .pyd file when you encounter malware obfuscated with PyArmor? Sure, okay, that simplifies things.
One HTTP request to a Zyxel GS1900 switch hands attackers full control of your network edge. https://intel.threadlinqs.com/threat/TL-2026-2611 #ThreatIntel #CVE_2026_7273 #PyArmor #Kapibala
September 21, 2026 at 10:35 PM
One HTTP request to a Zyxel GS1900 switch hands attackers full control of your network edge. https://intel.threadlinqs.com/threat/TL-2026-2611 #ThreatIntel #CVE_2026_7273 #PyArmor #Kapibala
Obfuscated Malicious Python Scripts with PyArmor https://isc.sans.edu/diary/31840
April 9, 2025 at 6:31 AM
Obfuscated Malicious Python Scripts with PyArmor https://isc.sans.edu/diary/31840
VVS Stealer Uses PyArmor Obfuscation to Evade Static Analysis and Signature Detection
VVS Stealer Uses PyArmor Obfuscation to Evade Static Analysis and Signature Detection
cybersecuritynews.com
January 3, 2026 at 9:30 AM
VVS Stealer Uses PyArmor Obfuscation to Evade Static Analysis and Signature Detection
We're live! Let's break a malware loader that uses Pyarmor 9+ with Frida! twitch.tv/InvokeRevers...
InvokeReversing - Live on Twitch
🔥Breaking Pyarmor 9 with Frida🔥 | Streaming software and game development.
twitch.tv
August 11, 2026 at 5:23 PM
We're live! Let's break a malware loader that uses Pyarmor 9+ with Frida! twitch.tv/InvokeRevers...
Originally from Unit 42: VVS Discord Stealer Using Pyarmor for Obfuscation and Detection Evasion ( :-{ı▓ #unit42 #threathunting #cyberresearch
VVS Discord Stealer Using Pyarmor for Obfuscation and Detection Evasion
VVS stealer (or VVS $tealer) is a Python-based infostealer targeting Discord users. It employs Pyarmor for obfuscation, contributing to its efficacy.
The post VVS Discord Stealer Using Pyarmor for Obfuscation and Detection Evasion appeared first on Unit 42.
unit42.paloaltonetworks.com
January 3, 2026 at 10:27 AM
Originally from Unit 42: VVS Discord Stealer Using Pyarmor for Obfuscation and Detection Evasion ( :-{ı▓ #unit42 #threathunting #cyberresearch
SANS Stormcast ThursdayApril 10th: Getting Past PyArmor; CenterStack RCE; Android 0-Day Patch; VMware Tanzu Patches; Odd Win11 Directory; WhatsApp File Confusion; SANS AI Guide;
https://isc.sans.edu/podcastdetail/9402
https://isc.sans.edu/podcastdetail/9402
April 10, 2025 at 2:00 AM
SANS Stormcast ThursdayApril 10th: Getting Past PyArmor; CenterStack RCE; Android 0-Day Patch; VMware Tanzu Patches; Odd Win11 Directory; WhatsApp File Confusion; SANS AI Guide;
https://isc.sans.edu/podcastdetail/9402
https://isc.sans.edu/podcastdetail/9402
it's nice enough to give you debug if u run the script directly but it just ends up being generic miner malware
interestingly they check if ur useragent is powershell but only when you dl script not for the actual zip with the trial version of pyarmor obfuscated python script that downloads xmrig
interestingly they check if ur useragent is powershell but only when you dl script not for the actual zip with the trial version of pyarmor obfuscated python script that downloads xmrig
![[HASH] xmrig-6.26.v2.zip verified OK](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:ocigo7hqqucgr5qfj2tehz5q/bafkreid2tho5kn6an55whzcwgy6socc6coymw6re2j6zmnfgkfjery7mya)
May 30, 2026 at 6:04 PM
it's nice enough to give you debug if u run the script directly but it just ends up being generic miner malware
interestingly they check if ur useragent is powershell but only when you dl script not for the actual zip with the trial version of pyarmor obfuscated python script that downloads xmrig
interestingly they check if ur useragent is powershell but only when you dl script not for the actual zip with the trial version of pyarmor obfuscated python script that downloads xmrig
VVS Discord Stealer Using Pyarmor for Obfuscation and Detection Evasion
VS Stealer, a Python-based information-stealing malware, is targeting Discord users to steal their data, including exfiltrating sensitive information like credentials and tokens stored in their accounts. Unit 42 has more…
VS Stealer, a Python-based information-stealing malware, is targeting Discord users to steal their data, including exfiltrating sensitive information like credentials and tokens stored in their accounts. Unit 42 has more…
VVS Discord Stealer Using Pyarmor for Obfuscation and Detection Evasion
VS Stealer, a Python-based information-stealing malware, is targeting Discord users to steal their data, including exfiltrating sensitive information like credentials and tokens stored in their accounts. Unit 42 has more details here: Martin Jartelius, AI Product Director at Outpost24, provided the following comments: “This is in line with the “malware as a service” elements we have seen over the years.
itnerd.blog
January 15, 2026 at 7:34 PM
VVS Discord Stealer Using Pyarmor for Obfuscation and Detection Evasion
VS Stealer, a Python-based information-stealing malware, is targeting Discord users to steal their data, including exfiltrating sensitive information like credentials and tokens stored in their accounts. Unit 42 has more…
VS Stealer, a Python-based information-stealing malware, is targeting Discord users to steal their data, including exfiltrating sensitive information like credentials and tokens stored in their accounts. Unit 42 has more…
New VVS Stealer Malware Targets Discord Accounts via Obfuscated Python Code
Cybersecurity researchers have disclosed details of a new Python-based information stealer called VVS Stealer (also styled as VVS $tealer) that's capable of harvesting Discord credentials and tokens.
The …
#hackernews #news
Cybersecurity researchers have disclosed details of a new Python-based information stealer called VVS Stealer (also styled as VVS $tealer) that's capable of harvesting Discord credentials and tokens.
The …
#hackernews #news
New VVS Stealer Malware Targets Discord Accounts via Obfuscated Python Code
Cybersecurity researchers have disclosed details of a new Python-based information stealer called VVS Stealer (also styled as VVS $tealer) that's capable of harvesting Discord credentials and tokens.
The stealer is said to have been on sale on Telegram as far back as April 2025, according to a report from Palo Alto Networks Unit 42.
"VVS stealer's code is obfuscated by Pyarmor," researchers
thehackernews.com
January 6, 2026 at 3:37 AM
New VVS Stealer Malware Targets Discord Accounts via Obfuscated Python Code
Cybersecurity researchers have disclosed details of a new Python-based information stealer called VVS Stealer (also styled as VVS $tealer) that's capable of harvesting Discord credentials and tokens.
The …
#hackernews #news
Cybersecurity researchers have disclosed details of a new Python-based information stealer called VVS Stealer (also styled as VVS $tealer) that's capable of harvesting Discord credentials and tokens.
The …
#hackernews #news
Check out our new blog on breaking Efimer's infection chain with Frida: invokere.com/posts/2026/0... it includes details of follow-on payloads, using a known plaintext attack, a full extractor and detection rules.
Breaking Efimer’s Pyarmor Infection Chain with Frida
In the summer of 2026, Invoke RE began seeing the Efimer loader delivering a Pyarmor infection chain leading to a JavaScript clipper variant. We used the Frida dynamic instrumentation framework to bre...
invokere.com
September 7, 2026 at 1:45 PM
Check out our new blog on breaking Efimer's infection chain with Frida: invokere.com/posts/2026/0... it includes details of follow-on payloads, using a known plaintext attack, a full extractor and detection rules.
We've uploaded our live stream from August 18th where we broke Pyarmor with Frida to recover JavaScript malware payloads, enjoy! www.youtube.com/watch?v=5jMK...
Breaking Efimer Loader with Frida (Stream - 18/08/2026)
YouTube video by Invoke RE
www.youtube.com
August 26, 2026 at 2:22 PM
We've uploaded our live stream from August 18th where we broke Pyarmor with Frida to recover JavaScript malware payloads, enjoy! www.youtube.com/watch?v=5jMK...
Cybersecurity researchers reveal TWINLOOT, a new modular Python implant using PyArmor, running C2 infrastructure via trusted Microsoft services like SharePoint Online.
TWINLOOT Abuses SharePoint and Teams to Steal Credentials and Move Across Networks
TWINLOOT uses SharePoint, Teams TURN, and headless Edge for C2, steals Windows credentials, and opens SOCKS5 access into victim networks.
thehackernews.com
August 21, 2026 at 3:30 PM
Cybersecurity researchers reveal TWINLOOT, a new modular Python implant using PyArmor, running C2 infrastructure via trusted Microsoft services like SharePoint Online.
TWINLOOT Abuses SharePoint and Teams to Steal Credentials and Move Across Networks
Cybersecurity researchers have disclosed details of a previously undocumented Python implant framework dubbed TWINLOOT.
"TWINLOOT is a modular, PyArmor-hardened Python implant designed …
#hackernews #microsoft #news
Cybersecurity researchers have disclosed details of a previously undocumented Python implant framework dubbed TWINLOOT.
"TWINLOOT is a modular, PyArmor-hardened Python implant designed …
#hackernews #microsoft #news
TWINLOOT Abuses SharePoint and Teams to Steal Credentials and Move Across Networks
Cybersecurity researchers have disclosed details of a previously undocumented Python implant framework dubbed TWINLOOT.
"TWINLOOT is a modular, PyArmor-hardened Python implant designed to operate its entire command-and-control infrastructure inside trusted Microsoft services," Ontinue said in a technical report shared with The Hacker News. "Tasking flows through SharePoint Online file
thehackernews.com
August 19, 2026 at 10:48 AM
TWINLOOT Abuses SharePoint and Teams to Steal Credentials and Move Across Networks
Cybersecurity researchers have disclosed details of a previously undocumented Python implant framework dubbed TWINLOOT.
"TWINLOOT is a modular, PyArmor-hardened Python implant designed …
#hackernews #microsoft #news
Cybersecurity researchers have disclosed details of a previously undocumented Python implant framework dubbed TWINLOOT.
"TWINLOOT is a modular, PyArmor-hardened Python implant designed …
#hackernews #microsoft #news
🤖 TWINLOOT: undocumented Python implant runs its entire C2 inside Microsoft cloud. PyArmor-hardened; tasking via SharePoint, abuses Teams to steal credentials.
https://thehackernews.com/2026/08/twinloot-abuses-sharepoint-and-teams-to-steal-credentials-and-move-across-networks.html
https://thehackernews.com/2026/08/twinloot-abuses-sharepoint-and-teams-to-steal-credentials-and-move-across-networks.html
August 19, 2026 at 12:32 AM
🤖 TWINLOOT: undocumented Python implant runs its entire C2 inside Microsoft cloud. PyArmor-hardened; tasking via SharePoint, abuses Teams to steal credentials.
https://thehackernews.com/2026/08/twinloot-abuses-sharepoint-and-teams-to-steal-credentials-and-move-across-networks.html
https://thehackernews.com/2026/08/twinloot-abuses-sharepoint-and-teams-to-steal-credentials-and-move-across-networks.html
TWINLOOT is a PyArmor-hardened Python implant using Microsoft 365 services for C2, credential theft, command execution, pivoting, and persistence.
Save What Matters
Curate Feeds | Make Collections | Customize Email Briefs
briefly.co
August 18, 2026 at 1:12 PM
TWINLOOT is a PyArmor-hardened Python implant using Microsoft 365 services for C2, credential theft, command execution, pivoting, and persistence.
🤖 TWINLOOT: a PyArmor-hardened Python implant operating its entire C2 inside Microsoft cloud services, abusing SharePoint and Teams to steal credentials and move laterally.
https://thehackernews.com/2026/08/twinloot-abuses-sharepoint-and-teams-to.html
https://thehackernews.com/2026/08/twinloot-abuses-sharepoint-and-teams-to.html
August 18, 2026 at 2:22 PM
🤖 TWINLOOT: a PyArmor-hardened Python implant operating its entire C2 inside Microsoft cloud services, abusing SharePoint and Teams to steal credentials and move laterally.
https://thehackernews.com/2026/08/twinloot-abuses-sharepoint-and-teams-to.html
https://thehackernews.com/2026/08/twinloot-abuses-sharepoint-and-teams-to.html
Vanta Stealer uses dual-layer PyArmor obfuscation to evade detection while stealing credentials across 8 app categories. https://intel.threadlinqs.com/threat/TL-2026-1914 #ThreatIntel #Python #Expressjs #Vanta
August 6, 2026 at 12:24 PM
Vanta Stealer uses dual-layer PyArmor obfuscation to evade detection while stealing credentials across 8 app categories. https://intel.threadlinqs.com/threat/TL-2026-1914 #ThreatIntel #Python #Expressjs #Vanta
Vantaスティーラー、PyArmorを悪用してブラウザのパスワードや暗号資産ウォレット、Discordトークンを窃取
Vanta Stealerは、Pythonベースでクロスプラットフォーム対応の情報窃取マルウェアです。PyInstallerでパッケージ化された実行ファイルの上にさらに多層のPyArmor難読化を施し、ブラウザに保存されたパスワード、暗号資産ウォレットのデータ、Discordトークン、ゲームアカウント、VPN設定、機...
Vanta Stealerは、Pythonベースでクロスプラットフォーム対応の情報窃取マルウェアです。PyInstallerでパッケージ化された実行ファイルの上にさらに多層のPyArmor難読化を施し、ブラウザに保存されたパスワード、暗号資産ウォレットのデータ、Discordトークン、ゲームアカウント、VPN設定、機...
Vantaスティーラー、PyArmorを悪用してブラウザのパスワードや暗号資産ウォレット、Discordトークンを窃取
Vanta Stealerは、Pythonベースでクロスプラットフォーム対応の情報窃取マルウェアです。PyInstallerでパッケージ化された実行ファイルの上にさらに多層のPyArmor難読化を施し、ブラウザに保存されたパスワード、暗号資産ウォレットのデータ、Discordトークン、ゲームアカウント、VPN設定、機
blackhatnews.tokyo
August 6, 2026 at 12:16 PM
Vantaスティーラー、PyArmorを悪用してブラウザのパスワードや暗号資産ウォレット、Discordトークンを窃取
Vanta Stealerは、Pythonベースでクロスプラットフォーム対応の情報窃取マルウェアです。PyInstallerでパッケージ化された実行ファイルの上にさらに多層のPyArmor難読化を施し、ブラウザに保存されたパスワード、暗号資産ウォレットのデータ、Discordトークン、ゲームアカウント、VPN設定、機...
Vanta Stealerは、Pythonベースでクロスプラットフォーム対応の情報窃取マルウェアです。PyInstallerでパッケージ化された実行ファイルの上にさらに多層のPyArmor難読化を施し、ブラウザに保存されたパスワード、暗号資産ウォレットのデータ、Discordトークン、ゲームアカウント、VPN設定、機...
Point Wild's LAT61 team analysed Vanta Stealer, a Python-based cross-platform infostealer targeting many apps & digital assets. A notable characteristic is its use of multiple PyArmor protection layers, combined with a PyInstaller-packaged executable. www.pointwild.com/threat-intel...
August 6, 2026 at 8:10 AM
Point Wild's LAT61 team analysed Vanta Stealer, a Python-based cross-platform infostealer targeting many apps & digital assets. A notable characteristic is its use of multiple PyArmor protection layers, combined with a PyInstaller-packaged executable. www.pointwild.com/threat-intel...
🟢 Armored serpent. Reversing Python applications protected with PyArmor obfuscator
🗨️ This article discusses PyArmor, a popular obfuscator for Python applications. Using the demo version of a real graphical…
#coding
🗨️ This article discusses PyArmor, a popular obfuscator for Python applications. Using the demo version of a real graphical…
#coding
Armored serpent. Reversing Python applications protected with PyArmor obfuscator
Read more
hackmag.com
July 27, 2026 at 1:00 PM
🟢 Armored serpent. Reversing Python applications protected with PyArmor obfuscator
🗨️ This article discusses PyArmor, a popular obfuscator for Python applications. Using the demo version of a real graphical…
#coding
🗨️ This article discusses PyArmor, a popular obfuscator for Python applications. Using the demo version of a real graphical…
#coding
The official JDownloader site was hacked to push installers that quietly switch off your antivirus. https://intel.threadlinqs.com/threat/TL-2026-1142 #ThreatIntel #r77 #JDownloader #PyArmor
July 7, 2026 at 12:07 AM
The official JDownloader site was hacked to push installers that quietly switch off your antivirus. https://intel.threadlinqs.com/threat/TL-2026-1142 #ThreatIntel #r77 #JDownloader #PyArmor
Armored Likho Targets Governments and Power Operators with BusySnake Stealer
Armored Likho Targets Governments and Power Operators with BusySnake Stealer
The Armored Likho APT group, uncovered by Kaspersky, is conducting cyber-espionage and financially motivated attacks against government agencies and electric-sector operators in Russia, Brazil, and Kazakhstan. The campaign centers on BusySnake, a Python-based stealer protected by PyArmor Pro 9.2.0 w
deafnews.it
July 6, 2026 at 4:12 PM
Armored Likho Targets Governments and Power Operators with BusySnake Stealer