STAC4749 PyArmour PyInstaller Backdoor with GitHub-hosted AES Key and workers.dev C2

Duo Tech@duotech

•updated Jul 31, 2026•0•0•4

Detects PyArmour-obfuscated PyInstaller backdoor binaries associated with STAC4749 that stage base_library.zip and communicate with workers.dev C2 infrastructure