Hades Loader Run Marker and Python Startup Hooks

Ethan Andrews@eandrews

•updated Jun 8, 2026•3•0•13

Detects the creation of the '.bun_ran' run-once marker in a temporary directory or suspicious Python '.pth' startup hooks (e.g., 'langchain_core-setup.pth') indicative of the Hades loader variant. The '.bun_ran' file acts as a marker for the loader, while '.pth' files can be used to inject malicious code into Python's import mechanism, achieving persistence or execution.