Hackers Use PyInstaller and AMSI Patching to Deliver XWorm RAT v7.4
2026-05-15T20:51:48Z•9b43c0fcb3f1bc5ded68be6aace2c5d8240374647722b9ca5d32852867374879
AMSI patchingCalPhishingDeed RATEvilTokensFDMTPFamousSparrowJobStealerM365 session theftMFA bypassMini Shai-HuludOIDC token hijack`,`ShinyHunters`,`data leak`,`Canvas`],Outlook calendar phishingProxyNotShellPyInstallerPyPIRATTeamPCPTwill TyphoonWindowsXWormcrypto-wallet theftdevice-code phishingmacOSnpmsupply-chain attack
What happened
Multiple active campaigns and supply-chain incidents: XWorm RAT v7.4 is being packaged inside PyInstaller executables and uses AMSI-patching to evade Windows defenses and enable data theft and remote control. A CalPhishing campaign leverages the EvilTokens kit, Outlook calendar invites and device-code phishing to steal Microsoft 365 session tokens and bypass MFA. Fake job-interview applications are delivering JobStealer on Windows and macOS to harvest browser data, passwords and crypto wallets. China-linked groups (FamousSparrow, Twill Typhoon) used Exchange server ProxyNotShell exploitation (
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- hackread
- Record identifier
- 9b43c0fcb3f1bc5ded68be6aace2c5d8240374647722b9ca5d32852867374879
- Enrichment time
- 2026-05-15T20:51:48Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.