Python Infostealer Hides in GitHub Releases to Bypass Detection

**Operation HumanitarianBait**: A targeted Python-based infostealer campaign leverages humanitarian-themed LNK phishing lures and GitHub Releases to bootstrap a PE-less Python runtime under %APPDATA%\\WindowsHelper, deploy PyArmor-protected payloads, maintain persistence via VBScript and a Scheduled Task named WindowsHelper, steal browser credentials and Telegram session data, log keystrokes, capture screenshots, and exfiltrate data to an nginx/Flask C2; the report includes SHA-256 hashes, malicious URLs, and guidance to monitor for related artifacts.