{"id":9993,"date":"2026-01-20T10:03:45","date_gmt":"2026-01-20T10:03:45","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/01\/20\/python-based-malware-solyximmortal-leverages-discord-to-silently-harvest-sensitive-data\/"},"modified":"2026-01-20T10:03:45","modified_gmt":"2026-01-20T10:03:45","slug":"python-based-malware-solyximmortal-leverages-discord-to-silently-harvest-sensitive-data","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/01\/20\/python-based-malware-solyximmortal-leverages-discord-to-silently-harvest-sensitive-data\/","title":{"rendered":"Python-based Malware SolyxImmortal Leverages Discord to Silently Harvest Sensitive Data"},"content":{"rendered":"

Python-based Malware SolyxImmortal Leverages Discord to Silently Harvest Sensitive Data
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

SolyxImmortal represents a notable advancement in information-stealing malware targeting Windows systems. <\/p>\n

This Python-based threat combines multiple data theft capabilities into a single, persistent implant designed for long-term surveillance rather than destructive activity. <\/p>\n

The malware operates silently in the background, collecting credentials, documents, keystrokes, and screenshots while sending stolen information directly to attackers through Discord webhooks. <\/p>\n

Its emergence in January 2026 marks a shift toward stealthier operational models that prioritize continuous monitoring<\/a> over rapid exploitation.<\/p>\n

The attack vector centers on distributing the malware, packaged as a legitimate-looking Python script<\/a> named \u201cLethalcompany.py,\u201d to target systems. <\/p>\n

\n
\"All
All execution behaviour is hardcoded (Source \u2013 Cyfirma)<\/figcaption><\/figure>\n<\/div>\n

Once executed, SolyxImmortal immediately establishes persistence through multiple mechanisms and launches background surveillance threads. <\/p>\n

The malware<\/a> does not spread laterally or propagate itself; instead, it focuses entirely on harvesting data from a single compromised device. <\/p>\n

This focused approach enables attackers to maintain long-term visibility into user activity without drawing attention.<\/p>\n

Cyfirma analysts identified<\/a> SolyxImmortal as a sophisticated threat that leverages legitimate Windows APIs and trusted platforms for command-and-control communication. <\/p>\n

\n
\"Persistence
Persistence Mechanism (Source \u2013 Cyfirma)<\/figcaption><\/figure>\n<\/div>\n

The malware\u2019s design reflects operational maturity, emphasizing reliability and stealth over complexity. <\/p>\n

By utilizing Discord webhooks for data transmission, attackers exploit the platform\u2019s reputation and HTTPS encryption to avoid network-based detection. <\/p>\n

This technique demonstrates how threat actors increasingly abuse legitimate services to hide malicious activity.<\/p>\n

Persistence Mechanism and Browser Credential Theft<\/strong><\/h2>\n

The malware establishes persistence by copying itself to a hidden location within the AppData directory, renaming it to resemble a legitimate Windows component. <\/p>\n

It then registers itself in the Windows registry Run key, ensuring automatic execution upon each user login without requiring administrative privileges<\/a>. <\/p>\n

\n
\"Document
Document and File Harvesting (Source \u2013 Cyfirma)<\/figcaption><\/figure>\n<\/div>\n

This approach guarantees continued operation even after system restarts.<\/p>\n

SolyxImmortal targets multiple browsers including Chrome, Edge, Brave, and Opera GX by accessing their profile directories. <\/p>\n

The malware extracts browser master encryption keys using Windows DPAPI, then decrypts stored credentials through AES-GCM encryption. <\/p>\n

Recovered credentials appear in plaintext format before exfiltration<\/a>, indicating minimal local security measures. <\/p>\n

The malware also harvests documents by scanning the user\u2019s home directory for files with specific extensions like .pdf, .docx, and .xlsx, filtering results by file size to avoid network overhead. <\/p>\n

\n
\"Final
Final data zip file (Source \u2013 Cyfirma)<\/figcaption><\/figure>\n<\/div>\n

All stolen artifacts are compressed into a ZIP archive and transmitted to attacker-controlled Discord webhooks, completing the data theft cycle.<\/p>\n

Follow us on\u00a0Google News<\/a>,\u00a0LinkedIn<\/a>,\u00a0and\u00a0X<\/a>\u00a0to Get More Instant Updates<\/strong>,\u00a0Set CSN as a Preferred Source in\u00a0Google<\/a>.<\/strong><\/p>\n

The post Python-based Malware SolyxImmortal Leverages Discord to Silently Harvest Sensitive Data<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

Python-based Malware SolyxImmortal Leverages Discord to Silently Harvest Sensitive Data SolyxImmortal represents a notable advancement in information-stealing malware targeting Windows systems. This Python-based threat combines multiple data theft capabilities into a single, persistent implant designed for long-term surveillance rather than destructive activity. The malware operates silently in the background, collecting credentials, documents, keystrokes, and screenshots […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,649],"tags":[130],"class_list":["post-9993","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-threats","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/9993"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=9993"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/9993\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=9993"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=9993"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=9993"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}