Operation Poisson: Python Keylogger Library Load with Temp File Write Correlation

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects the execution of Python interpreters or scripts involving keylogging-related libraries (pynput, pyxhook, pywin32, keyboard) or direct access to Linux input devices (/dev/input/event*), correlated with the creation of temporary script files, which is a common pattern for Python-based keyloggers.