Fake OSINT and GPT Utility GitHub Repos Spread PyStoreRAT Malware Payloads

PyStoreRAT is a modular, multi-stage JavaScript-based Remote Access Trojan distributed through GitHub repositories containing Python/JavaScript loader stubs. The malware uses fake OSINT tools, DeFi bots, GPT wrappers, and security utilities to target analysts and developers. Attack chain: loader stub downloads remote HTA file → executes via mshta.exe → delivers PyStoreRAT → deploys Rhadamanthys stealer. The malware can execute EXE, DLL, PowerShell, MSI, Python, JavaScript, and HTA modules. It establishes persistence via scheduled task disguised as NVIDIA update, profiles systems, checks admin privileges, scans for cryptocurrency wallets (Ledger Live, Trezor, Exodus, Atomic, Guarda, BitBox02), and implements evasion techniques for CrowdStrike Falcon and Cybereason/ReasonLabs detection.