macOS.Gaslight curl download of cpython-3.10.18 from astral-sh/python-build-standalone

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•2

Detects the download of a standalone CPython 3.10.18 interpreter from github.com/astral-sh/python-build-standalone using curl, followed by the extraction of the compressed archive using tar. This behavior is associated with the macOS.Gaslight malware's secondary collection module installer, which likely prepares a localized Python environment to execute further malicious tasks.