PyStoreRAT: AI-Driven Supply Chain Malware Targeting IT and OSINT Professionals

Summary

Morphisec uncovered a coordinated malware operation that abuses dormant GitHub accounts to host AI-generated repositories, which ultimately deliver a JavaScript/HTA backdoor dubbed PyStoreRAT. The loader profiles the host, deploys multiple payloads including the Rhadamanthys stealer, and dynamically adjusts its behavior when specific AV solutions are detected. It can propagate via removable media and relies on a rotating C2 infrastructure to refresh its modules. The campaign is aimed at IT administrators, security analysts, and OSINT professionals across the globe.

Investigation

Researchers examined the malicious GitHub projects, isolated the backdoor components, and documented the full execution chain, including system profiling, staged payload delivery, AV evasion, removable-drive spreading, and on-demand module loading. The report further describes the circular C2 node architecture that enhances resilience, as well as the use of Russian-language strings to validate the target’s locale. The analysis ties the loader to the Rhadamanthys stealer and highlights its capability to alter launch paths.

Mitigation

Morphisec advises using Automated Moving Target Defense to destabilize the loader’s runtime environment, block unreliable execution routes, and stop payload deployment. Because traditional signature-based controls are ineffective, defenders should rely on behavior-driven and virtualization-based protections. Restricting execution of scripts from untrusted origins and closely monitoring removable-drive activity are also recommended.

Response

When PyStoreRAT activity is identified, immediately isolate the impacted endpoint, terminate the backdoor process, and remove any persistent modules. Perform forensic analysis to collect IOCs, including C2 domains, file hashes, and scheduled tasks. Patch vulnerable software, enforce strict least-privilege execution policies, and continuously monitor GitHub for malicious or suspicious repository activity.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

• Attack Narrative & Commands:

  1. Reactivate a dormant account – the adversary uses the GitHub UI or API to change the account status from “dormant” to “active”.
  2. Publish an AI‑generated malicious repository – immediately after re‑activation, a new repository named ai‑osint‑toolkit is created, containing a README that advertises “AI‑generated projects”.
  3. Add a “maintenance” commit that embeds the PyStoreRAT backdoor; the commit message intentionally includes the word “maintenance” to satisfy the detection rule.
  4. Push the malicious code – the push generates a push audit event, but the rule we are testing only watches the account_reactivation audit entry, so the primary trigger is the re‑activation log entry with the flagged description.

• Regression Test Script: (Bash using GitHub CLI gh – assumes the attacking actor has a personal access token with admin:org scope)

    # simulate_attack.sh
    # Prerequisites: gh CLI installed and authenticated as the attacker
  
    # 1. Reactivate dormant account (simulated by updating a user field)
    gh api -X PATCH /admin/users/attacker_user 
        -f state=active 
        -f note="reactivation: AI-generated projects; maintenance commits scheduled"
  
    # 2. Create malicious repository
    gh repo create attacker_user/ai-osint-toolkit --public --description "AI‑generated OSINT tools"
  
    # 3. Add malicious file (PyStoreRAT) and commit
    cd ai-osint-toolkit
    echo "# PyStoreRAT backdoor" > pystorerat.py
    git add pystorerat.py
    git commit -m "Initial commit - maintenance commits: embed backdoor"
    git push origin main
  
    # 4. Optional: create a second maintenance commit to mimic real‑world activity
    echo "# Update README" >> README.md
    git add README.md
    git commit -m "maintenance commit: update documentation"
    git push origin main

• Cleanup Commands:

    # cleanup_attack.sh
    # Delete the malicious repository
    gh repo delete attacker_user/ai-osint-toolkit -y
  
    # Optionally, set the attacker account back to dormant (if API permits)
    gh api -X PATCH /admin/users/attacker_user -f state=dormant