Executive Summary
A sophisticated loading technique has been identified where attackers abuse the CPython path configuration file (`._pth`) to execute arbitrary code. By placing a renamed, validly signed Python executable in a user-writable directory alongside a malicious `._pth` file, the interpreter enters an isolated mode that imports attacker-controlled modules from a local archive. Because the configuration is handled by the file on disk, the process telemetry shows a clean command line with no arguments, bypassing traditional command-line detection rules.
The attack chain involves a multi-stage process starting with a phishing link hosted on Yahoo Mail, leading to a ZIP archive containing the Python runtime and a polyglot batch file. The batch file contains an XOR-obfuscated MSI package that the attacker attempts to install using a `fodhelper.exe` UAC bypass. While the elevation attempt in this case was blocked by endpoint privilege management and the lack of administrative rights, the loader successfully unpacked ScreenConnect as a persistence and remote access mechanism.
This threat highlights the limitations of hash-based blocking for signed runtimes and the importance of monitoring file-based configuration side-loading. Organizations should prioritize removing local administrative rights and monitoring for signed interpreters executing from unusual paths like `Downloads` or `Temp` without command-line arguments.