Operation HumanitarianBait Uses Aid-Themed Lures to Deploy a Python Infostealer

May 10, 2026 · Original article ↗

Summary

Cyble describes a campaign using Russian-language humanitarian-aid lures and malicious LNK files to deploy a persistent Python implant. Analysis found credential and data theft, surveillance, and covert remote-access capabilities; attribution remains inconclusive.

Key points

Phishing emails deliver a malicious LNK inside a RAR archive using Russian-language humanitarian-aid and survey lures; opening the shortcut starts the infection chain.
PowerShell extracts obfuscated content from the LNK and executes it in memory while a decoy document is shown to the victim.
The Python payload is protected with PyArmor and downloaded from GitHub Releases; a scheduled task and silent VBScript launchers maintain persistence.
Cyble's analysis found collection of browser passwords and cookies, keystrokes, clipboard contents, screenshots, Telegram session data, and selected files.
The implant can silently install RustDesk or AnyDesk for remote access and send collected data to a custom command-and-control server.
Cyble reports the campaign's command-and-control server was live as of May 2026. Attribution is inconclusive; Russian-language lures suggest Russian-speaking targets.

Article Details

Attack Vectors: Phishing emails deliver a malicious LNK file inside a RAR archive, using Russian-language humanitarian-aid and survey lures.
Opening the LNK triggers PowerShell to extract and execute obfuscated content in memory; a decoy PDF is shown while the Python implant is deployed.
The payload is downloaded from a GitHub Releases resource and obfuscated with PyArmor.
The implant establishes persistence with a recurring Windows Scheduled Task and silent VBScript launchers.
The implant collects browser credentials and cookies, keystrokes, clipboard contents, screenshots, Telegram session data, and selected local files, then uploads data to the C2 server.
The payload can silently install RustDesk or AnyDesk for remote desktop access.
Defensive Notes: Treat unsolicited archives and shortcut files with caution, and verify senders through a separate trusted channel before opening attachments.
Enable file extension visibility in Windows and audit Scheduled Tasks for unexpected tasks running at short intervals.
Monitor user-writable directories for self-contained scripting environments, obfuscated scripts, and non-administrative silent installation of remote desktop tools.
Monitor scripting interpreter activity and outbound HTTP connections from user-space processes; block traffic to known malicious infrastructure.
Alert on payload downloads from newly registered or low-reputation code-sharing accounts and maintain visibility into scheduled-task creation.

Indicators of compromise

Type	Indicator	Context
IPV4	`159[.]198[.]41[.]140`	Attacker-controlled C2 server used to host the login panel and receive collected data.
SHA256	`8a100cbdf79231e70cee2364ebd9a4433fda6b4de4929d705f26f7b68d6aeb79`	SHA-256 of the malicious initial LNK dropper.
SHA256	`9be61c95056fd6b63565cf51a196f2615f5360c0a42e616b2a618473e9d60a21`	SHA-256 of the malicious RAR archive delivered to victims.
SHA256	`a5b782901829861a6f458db404e8ec1a99c65a48393525e681742bb2a5db454d`	SHA-256 of module.pyw, identified as the packed Python stealer/RAT.
URL	`hxxp[:]//159[.]198[.]41[.]140/static/builder/lnk_uploads/invo[.]pdf`	C2-hosted humanitarian-aid lure PDF downloaded to the victim.
URL	`hxxp[:]//159[.]198[.]41[.]140/test/index.php?r=survey/index&sid=936926&newtest=Y&lang=ru%22`	Survey-based lure URL observed in the campaign.
URL	`hxxps[:]//github[.]com/leravalera2/dtfls/releases/download/dtfls/data.zip`	Specific GitHub Releases resource identified as the malicious payload download.