{
  "family": "pyspy",
  "sample_count": 1,
  "category": "trojan",
  "description": "TrojanSpy:Python/Pyspy represents a growing trend in malware development: threats written entirely in the Python programming language. Attackers leverage Python's extensive standard library and third-party modules to easily construct powerful InfoStealers and keyloggers. To run on target machines without requiring Python to be installed, attackers use tools like `PyInstaller` or `py2exe` to package the scripts into standalone Windows executables (`T1027.002`).<br><br><b>Understanding Pyspy (Python-Based Malware)</b><br>To an end-user, the infection is invisible, often disguised as a generic utility or document. For a security analyst, unpacking a Pyspy executable reveals the original Python source code, making reverse engineering relatively straightforward compared to compiled C++ malware. However, the use of `PyInstaller` often acts as a crude packing mechanism that can confuse legacy antivirus engines.<br><br><b>Execution and Extraction Mechanics</b><br>Pyspy is typically distributed via phishing or Discord/Telegram channels. When the packaged executable runs, it extracts a bundled Python interpreter and the malicious script into a temporary directory (like `_MEIxxxxxx`) in `%Temp%` and executes it (`T1059.006`). The Python script then utilizes libraries like `sqlite3` to dump browser passwords (`T1552.001`), `pynput` for keylogging (`T1056.001`), and `requests` to exfiltrate the stolen data to a C2 server or a Discord Webhook (`T1041`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is rapid credential theft and intellectual property loss. Host-based IoCs are highly specific: EDR alerts for the creation of `_MEI` temporary folders containing `python.dll` and `.pyd` files, and the execution of those bundled Python environments from untrusted directories. Network IoCs often include outbound HTTPS traffic to Discord Webhooks or Telegram APIs, which attackers frequently abuse as free C2 infrastructure.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1027.002",
    "T1552.001",
    "T1041",
    "T1059.006"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1059.006",
      "name": "Command and Scripting Interpreter: Python (Abusing the bundled interpreter to execute the payload)",
      "tactic": "Execution"
    },
    {
      "id": "T1027.002",
      "name": "Obfuscated Files or Information: Software Packing (Using PyInstaller to bundle and hide the script)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1552.001",
      "name": "Credentials In Files (Stealing saved browser passwords and crypto wallets)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1041",
      "name": "Exfiltration Over C2 Channel (Sending stolen data, often via Discord Webhooks)",
      "tactic": "Exfiltration"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint to prevent further data exfiltration, though Python stealers execute very rapidly.",
    "Assume all credentials stored in web browsers (Chrome, Edge, Firefox) on the infected machine have been compromised and initiate a password reset.",
    "Analyze network logs for anomalous outbound connections to Discord or Telegram APIs, which are frequently abused by Python malware.",
    "Extract the original `.pyc` or `.py` files from the `_MEI` temporary directory or memory dump to analyze the attacker's exact logic and C2 endpoints."
  ],
  "what_to_avoid": [
    "Do not assume a file is safe just because it lacks complex packing; PyInstaller bundles are a massive vector for InfoStealers.",
    "Avoid treating the incident as closed once the malware is removed; the stolen credentials are already in the hands of the attackers."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}