Last Updated: 2026-08-24T14:49:19Z
What’s Happening
The latest research from Marcus Hutchins (malwaretech) at Expel is a humdinger of a read, with some really creative behaviors.
First, we have Teams phishing as a delivery mechanism. I don’t know how many folks have reviewed their external access Teams policies, but the more you can lock them down, the better.
Then you have obfuscated PowerShell (a classic), that creates Script Blocks via [System.Management.Automation.ScriptBlock]::Create($). And then you have a self-contained Python interpreter that produces a C2 implant. There are also .NET assemblies loaded via the Python program, which is new to me. You also have Scheduled Task Creation via COM object to avoid common schtasks detections.
But all that is not the most interesting part to me.
No, that’s later for persistence, in which the malware creates a full-screen popup that mimics the Windows lock screen to immediately phish user credentials.
Above, the fake lock screen. Below, the real one.
It’s so simple, yet brilliant.
Actions
To me, the biggest defensive opportunity in this sample is the Python execution. Python requires a .py extension for loaded programs and modules, so the malware can’t obfuscate that easily. Nonstandard (or unapproved!) processes reading .py files is a deep detection, but if well-tuned, quite powerful.
Separately, no matter how you make your Scheduled Task for persistence, an XML file lands in C:\Windows\System32\Tasks and an entry is created in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache. Make sure your Scheduled Tasks alerting covers all Task creation methods.
I know I know, but 
user education around this kind of attack may be useful. “What does the Lock Screen look like?” etc.
Notes
Indicators have been added to MISP.