New Python Backdoor Uses Tunneling Service to Steal Browser and Cloud Credentials

DEEP#DOOR is a Python-based backdoor framework with persistent access and information harvesting capabilities.

• •Initial batch script disables Windows security and establishes persistence via startup scripts, registry keys, and scheduled tasks.
• •Uses bore.pub tunneling service to enable reverse shells, keylogging, screenshot capture, and credential harvesting from browsers and cloud services.
• •Implements extensive anti-analysis mechanisms including sandbox/VM detection, AMSI/ETW patching, and Defender tampering.
• •Employs watchdog mechanism to automatically recreate persistence artifacts.
• •Embeds payload directly within dropper to minimize external dependencies and forensic visibility.

This summary was automatically generated by AI based on the original article and may not be fully accurate.