PylangGhostMalware
Python-version of GolangGhost RATFrom MISP Galaxy
Last reported 3 months ago, by Infosecurity Magazine1 report
ATT&CK techniques
5 techniques · each with the sentence it comes from- T1059.005Visual Basic
“It then leverages a Visual Basic Script to silently unpack a Python runtime.”
- T1176.001Browser Extensions
“The integrated stealer module targets more than 80 distinct browser extensions.”
- T1552.004Private Keys
“It is specifically programmed to harvest session data, saved credentials and private keys from widely used cryptocurrency wallets such as MetaMask, Phantom and TronLink, as well as commercial password managers like NordPass.”
- T1555.005Password Managers
“…credentials and private keys from widely used cryptocurrency wallets such as MetaMask, Phantom and TronLink, as well as commercial password managers like NordPass.”
- T1684Social Engineering
“A new sophisticated social engineering operation targeting Web3 and cryptocurrency professionals has been identified by researchers at SOCRadar.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Researchers Uncover North Korean 'ClickFake' Campaign Targeting Web3 Pros“The Windows Vector and PylangGhost”
Thanks — we review every report.