InvisibleFerret Creates a .mod Launcher for a Cython Extension

Daniel Jeremiah@daniyyell

•updated Jun 20, 2026•0•0•1

Detects the creation of a Python launcher file with a '.mod' extension in temporary or user library directories by common script hosts (node, python, wscript, cscript, powershell). This activity is indicative of the InvisibleFerret malware (also known as Void DoKkaebi or BeaverTail) which uses such launchers to import newly downloaded .pyd or .so extensions and supply runtime connection arguments.