Hackers Attacking IT & OSINT Professionals with New PyStoreRAT to Gain Remote Access

A sophisticated supply-chain campaign is reactivating dormant GitHub accounts to publish AI-generated projects that later receive malicious maintenance commits installing a backdoor called PyStoreRAT; the loader profiles victims, deploys payloads including the Rhadamanthys stealer, spreads via removable drives, adapts execution to avoid AVs, and uses resilient rotating C2 nodes — targeting IT administrators and OSINT professionals.