Exploring FBot  | Python-Based Malware Targeting Cloud and Payment Services

FBot is a compact Python-based cloud hacktool/infostealer observed from July 2022 to January 2024 that harvests credentials and targets web, cloud, and SaaS services—particularly AWS, Office365, PayPal, Sendgrid, and Twilio. Key capabilities include generating and validating API keys, checking AWS SES/EC2 quotas, creating an AWS admin user (iDevXploit / MCDonald2021D#1337), scanning for exposed configuration files and CMS fingerprints, and utilities for spamming and account validation; the report includes SHA1 indicators and recommends enabling MFA and alerting on new AWS users and major SaaS configuration changes.