Operation Poisson KeyL.zip Python Keylogger Deployment via VBScript

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•2

Detects activity associated with Operation Poisson credential theft, specifically the use of VBScript (sys.vbs) to launch a Python keylogger (pynput or keyboard library) or the installation of keylogger dependencies via pip. It also includes a hash match for a known artifact (KeyL.zip).