SYMBOLCOMMON_NAMEaka. SYNONYMS
py.pylangghost (Back to overview)

PylangGhost

aka: ICEBITE.PYTHON, WeaselStore

Actor(s): WageMole

Python-version of GolangGhost RAT

References
2026-06-22 ⋅ JFrog Security ⋅ Yair Benamou
From PostCSS Masquerading to Windows RAT
PylangGhost
2026-05-01 ⋅ kmsec ⋅ Kieran Miyamoto
North Korea's abuse of Cloudflare Workers and Pages
PylangGhost
2026-03-23 ⋅ Sophos ⋅ Sophos Counter Threat Unit Research Team
NICKEL ALLEY strategy: Fake it ‘til you make it
PylangGhost GolangGhost Nickel Alley
2026-03-13 ⋅ kmsec ⋅ Kieran Miyamoto
First instance of PylangGhost RAT observed on npm
PylangGhost
2026-03-11 ⋅ Microsoft ⋅ Microsoft Defender Experts, Microsoft Defender Security Research Team
Contagious Interview: Malware delivered through fake developer job interviews
BeaverTail OtterCookie StoatWaffle InvisibleFerret PylangGhost GolangGhost Contagious Interview
2026-03-09 ⋅ Abstract Security ⋅ Abstract Security Threat Research Organization (ASTRO)
Contagious Interview: Evolution of VS Code and Cursor Tasks Infection Chains Part 2
GolangGhost PylangGhost GolangGhost
2026-02-25 ⋅ Abstract Security ⋅ Abstract Security Threat Research Organization (ASTRO)
Contagious Interview: Evolution of VS Code and Cursor Tasks Infection Chains - Part 1
BeaverTail PylangGhost GolangGhost
2025-12-17 ⋅ Recorded Future ⋅ Insikt Group
PurpleBravo’s Targeting of the IT Software Supply Chain
BeaverTail InvisibleFerret PylangGhost GolangGhost
2025-09-25 ⋅ Virus Bulletin ⋅ Matěj Havránek, Peter Kálnai
DeceptiveDevelopment: From primitive crypto theft to sophisticated AI-based deception
BeaverTail OtterCookie InvisibleFerret PylangGhost AkdoorTea GolangGhost Tropidoor TsunamiKit
2025-09-25 ⋅ ESET Research ⋅ Matěj Havránek, Peter Kálnai
DeceptiveDevelopment: From primitive crypto theft to sophisticated AI-based deception
BeaverTail OtterCookie InvisibleFerret PylangGhost AkdoorTea GolangGhost Tropidoor TsunamiKit
2025-09-10 ⋅ ANY.RUN ⋅ ANY.RUN
Lazarus Group Attacks in 2025: Here’s Everything SOC Teams Need to Know
OtterCookie InvisibleFerret PylangGhost
2025-08-06 ⋅ ANY.RUN ⋅ Mauro Eldritch
PyLangGhost RAT: Rising Stealer from Lazarus Group Striking Finance and Technology
PylangGhost GolangGhost
2025-06-23 ⋅ PolySwarm Tech Team ⋅ The Hivemind
Famous Chollima’s PylangGhost
GolangGhost PylangGhost GolangGhost
2025-06-18 ⋅ Cisco Talos ⋅ Vanja Svajcer
Famous Chollima deploying Python version of GolangGhost RAT
GolangGhost PylangGhost GolangGhost

There is no Yara-Signature yet.