Lazarus InvisibleFerret Python Infostealer Spawned by Developer Tools

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•4

This rule detects suspicious activities originating from Python processes spawned by development tools like VS Code, Node.js, or npm. It flags potential credential access when such processes attempt to read sensitive files (e.g., browser profiles, SSH keys, cloud configuration files) or perform suspicious network communication to external, non-standard ports, which may indicate data exfiltration or command-and-control behavior.