This report analyzes a malware campaign initially identified as a Python-based infostealer that ultimately leads to the deployment of PureRAT, a commercially available remote access trojan (RAT). The campaign involves multiple stages and tools, including various loaders and stealers, culminating in full RAT capabilities. Indicators such as IP addresses and file hashes are provided for detection and blocking. No specific affected software versions or CVEs are identified. The threat is assessed as medium severity due to its capability to escalate from information theft to full remote access.
TinkyWinkey is a sophisticated Windows-based keylogger that combines persistent service execution, low-level keyboard hooks, and comprehensive system profiling. It captures all keystrokes, including special keys and multi-language input, alongside detailed system metrics such as CPU, memory, OS version, and network identifiers. The malware uses DLL injection into trusted processes and service-based persistence for stealth. It creates a log file in the user's temp directory, recording system reconnaissance details and user activity data. First observed in June 2025, TinkyWinkey exemplifies the evolving threat landscape, leveraging advanced programming techniques to maintain stealth and maximize data capture. Organizations should monitor for unusual service activity, unexpected DLL injections, and persistent logging patterns to mitigate this threat.
