Fraud Investigation Reveals Sophisticated Python Malware

Secuinfra uncovered a sophisticated Python-based malware deployment discovered after a fraud investigation: attackers used hidden PowerShell downloads (svchoss.exe) from an IP hosted in Tencent networks, deployed an obfuscated PyInstaller payload and a concealed Python environment, and operated Cobalt Strike beacons and persistence via startup scripts; extracted artifacts indicate credential- and wallet-theft and active unauthorized PayPal transfers.