Python Infostealer Uses GitHub Releases To Bypass Security Tools

Operation HumanitarianBait is an active cyberespionage campaign that delivers a stealthy, Python-based infostealer via phishing emails containing a malicious LNK file inside a RAR archive. The attack executes PowerShell to run obfuscated payloads in memory, fetches the primary implant from GitHub Releases (to blend with legitimate traffic), uses PyArmor obfuscation, and exfiltrates browser credentials, Telegram sessions, keystrokes, clipboard data and screenshots while establishing persistence and remote access via scheduled tasks and legitimate remote‑access tools.