New Python Backdoor Uses Tunneling Service to Steal Browser and Cloud Credentials

Securonix researchers disclosed DEEP#DOOR, a stealthy Python-based backdoor/RAT that embeds its implant in a dropper, disables Windows security controls, establishes multi-mechanism persistence, and communicates over the public tunneling service bore.pub to enable remote command execution, system reconnaissance, keylogging, credential and cloud-credential theft, and extensive surveillance, while employing numerous anti-analysis and telemetry tampering techniques; observed usage appears limited and somewhat targeted with no evidence of large-scale campaigns.