{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata — refreshed continuously.","feed_url":"https://feed.craftedsignal.io/tags/python/","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cves":[],"_cs_exploited":false,"_cs_products":[],"_cs_severities":["medium"],"_cs_tags":["persistence","macos","python"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThis threat brief highlights the malicious use of Python to establish persistence on macOS systems. Attackers can achieve Python code execution through various means, including malicious scripts, compromised dependencies, or even model file deserialization vulnerabilities (such as pickle or PyTorch \u003ccode\u003e__reduce__\u003c/code\u003e exploits). Once code execution is achieved, attackers can drop plist files into LaunchAgent or LaunchDaemon directories, ensuring their payload survives reboots and user logouts. This persistence mechanism allows the attacker to maintain access and control over the compromised host. Legitimate Python processes typically do not create persistence mechanisms in this manner, making the first occurrence of such activity a strong indicator of compromise.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker gains initial access to the macOS system through methods such as exploiting vulnerabilities, social engineering, or phishing.\u003c/li\u003e\n\u003cli\u003eThe attacker achieves code execution within a Python process. This can occur via a malicious script, a compromised Python package, or by exploiting deserialization vulnerabilities like \u003ccode\u003epickle.load\u003c/code\u003e or \u003ccode\u003etorch.load\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe malicious Python script crafts a LaunchAgent or LaunchDaemon plist file. This plist file contains configuration details about the program to be executed, including its path, arguments, and execution triggers.\u003c/li\u003e\n\u003cli\u003eThe Python process writes the crafted plist file to either the \u003ccode\u003e/Library/LaunchAgents/\u003c/code\u003e (for user-level persistence) or \u003ccode\u003e/Library/LaunchDaemons/\u003c/code\u003e (for system-level persistence) directory.\u003c/li\u003e\n\u003cli\u003eThe LaunchAgent or LaunchDaemon is automatically loaded by \u003ccode\u003elaunchd\u003c/code\u003e at login or boot, according to the configuration specified in the plist file.\u003c/li\u003e\n\u003cli\u003eThe program specified in the plist file is executed, giving the attacker persistent access to the compromised system.\u003c/li\u003e\n\u003cli\u003eThe attacker can then use this persistent access to perform various malicious activities, such as data exfiltration, lateral movement, or deploying additional malware.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eA successful attack can lead to persistent compromise of macOS systems. Attackers can maintain unauthorized access, execute arbitrary code, steal sensitive data, or use the compromised system as a foothold for further attacks within the network. The impact can range from individual user data theft to widespread organizational breaches, depending on the attacker\u0026rsquo;s objectives and the system\u0026rsquo;s role within the network.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026ldquo;Detect Python Launch Agent/Daemon Creation\u0026rdquo; to your SIEM to identify when a Python process creates a LaunchAgent or LaunchDaemon plist file.\u003c/li\u003e\n\u003cli\u003eEnable Elastic Defend endpoint logging to capture \u003ccode\u003eevent.action:\u0026quot;launch_daemon\u0026quot;\u003c/code\u003e events, which are necessary for the Sigma rule to function correctly.\u003c/li\u003e\n\u003cli\u003ePrioritize investigation of alerts generated by the Sigma rule, focusing on understanding the program arguments, run-at-load configuration, and keep-alive settings within the created plist file.\u003c/li\u003e\n\u003cli\u003eImplement strict dependency management and vulnerability scanning for Python environments to prevent the use of compromised packages.\u003c/li\u003e\n\u003cli\u003eMonitor for processes loading model files (\u003ccode\u003etorch.load\u003c/code\u003e, \u003ccode\u003epickle.load\u003c/code\u003e) and investigate any suspicious activity to prevent exploitation of deserialization vulnerabilities.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-04-08T21:12:54Z","date_published":"2026-04-08T21:12:54Z","id":"/briefs/2026-06-python-launch-agent-persistence/","summary":"This rule detects the initial creation or modification of a macOS LaunchAgent or LaunchDaemon plist file by a Python process, a common persistence technique employed by attackers using malicious scripts, compromised dependencies, or model file deserialization.","title":"First Time Python Process Creates macOS Launch Agent or Daemon","url":"https://feed.craftedsignal.io/briefs/2026-06-python-launch-agent-persistence/"},{"_cs_actors":[],"_cs_cves":[],"_cs_exploited":false,"_cs_products":[],"_cs_severities":["high"],"_cs_tags":["memory-exhaustion","vulnerability","denial-of-service","python","supply-chain"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eA critical memory exhaustion vulnerability, identified as CVE-2026-33155, has been discovered in a widely used Python library downloaded approximately 29 million times per month. This vulnerability poses a significant threat to services that rely on the affected library, including Amazon SageMaker, DataHub, and acryl-datahub. The issue stems from an incomplete patch for a previous vulnerability, CVE-2025-58367, related to restricted unpickling. Organizations that applied the initial patch may…\u003c/p\u003e\n","date_modified":"2026-03-19T17:46:05Z","date_published":"2026-03-19T17:46:05Z","id":"/briefs/2026-03-memory-exhaustion-flaw/","summary":"A memory exhaustion vulnerability (CVE-2026-33155) exists in a widely used Python library, affecting services like SageMaker, DataHub, and acryl-datahub due to an incomplete patch for CVE-2025-58367, requiring pinning to version 8.6.2.","title":"Memory Exhaustion Vulnerability in Widely Used Python Library","url":"https://feed.craftedsignal.io/briefs/2026-03-memory-exhaustion-flaw/"}],"language":"en","title":"CraftedSignal Threat Feed — Python","version":"https://jsonfeed.org/version/1.1"}