InvisibleFerret Python Infostealer Spawned from VS Code or Node.js

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects behavior indicative of the InvisibleFerret information stealer, specifically focusing on Python execution spawned by development tools (VS Code/Node.js), unauthorized access to browser-based credential stores or local crypto wallets, and suspicious outbound network activity originating from Python processes spawned by development/automation tools.