Fake OSINT and GPT Utility GitHub Repos Spread PyStoreRAT Malware Payloads

Cybersecurity researchers have identified a novel campaign exploiting GitHub-hosted Python repositories, which are disguised as development utilities or OSINT tools, to distribute PyStoreRAT, a previously undocumented JavaScript-based Remote Access Trojan. These repositories contain minimal code that covertly downloads and executes a remote HTA (HTML Application) file, enabling attackers to establish persistent remote access. This development highlights a sophisticated method of malware delivery that leverages legitimate code hosting platforms to evade detection and underscores the need for vigilant monitoring of open-source repositories for malicious activity.