InvisibleFerret Python Backdoor Credential Exfiltration via HTTPS or Telegram

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•6

Detects Python processes spawned by development tools (VSCode, Cursor) or Node.js that are engaged in suspicious activities, specifically communicating with the Telegram Bot API or uploading large amounts of data, often accompanied by file staging (ZIP archive creation). This behavior is characteristic of the InvisibleFerret information stealer.