#DISCORD IMAGE TOKEN GRABBER SOFTWARE#

After conducting an analysis, it was noticed that the PyInstaller malware executable was created utilizing an open-source GitHub project known as “PySilon,” a Remote Access Trojan (RAT). We presume that this executable comes from a phishing website. On September 13th, CRIL came across a PyInstaller file named “Adobe Photoshop.exe” on VirusTotal. The upward trend in these samples suggests a growing usage of PySilon RAT.įigure 1- Rise of PySilon RAT (Stats Source- VirusTotal) It has been noted that over 300 samples of this malware have been reported on VirusTotal since June 2023. CRIL has recently come across multiple instances of PySilon RAT, an open-source malware. Threat Actors (TAs) resort to open-source malware available on platforms like GitHub due to its convenience, advanced functionalities, and adaptability.

#DISCORD IMAGE TOKEN GRABBER SOFTWARE#

CRIL has also detected numerous samples that imitate software, tools, and cracks suspecting their origin from phishing websites, free software downloading websites, etc.The current version boasts advanced malware capabilities, including its ability to record keystrokes, steal sensitive information, capture screen activity, execute remote commands, and perform additional functions.PySilon RAT was first established in December 2022 as version 1.0 and has since evolved to its current iteration, version 3.6.The presence of over 300 samples on VirusTotal since June 2023 suggests a significant surge in the PySilon malware’s activity.Cyble Research and Intelligence Labs (CRIL) has observed the usage of an open-source PySilon RAT by multiple threat actors (TAs).

Discord image token grabber