- Operation HumanitarianBait uses fake Russian aid documents delivered via phishing emails to deploy Python spyware, with the payload hosted on GitHub Releases to blend in with legitimate software traffic.
- The malware steals browser passwords, Telegram session data, and cryptocurrency private keys – while also logging keystrokes, capturing screenshots, and installing remote desktop tools for full system access.
- Attackers ensure persistence through a Windows Scheduled Task that restarts the malware on every reboot, with command-and-control infrastructure hosted on Namecheap and managed through a Flask backend.
Cybersecurity researchers have found a spyware campaign that lures Russian-speaking people with fake humanitarian aid using false claims of financial support. The operation, dubbed Operation HumanitarianBait, weaponizes the very files designed to help vulnerable people.
The attackers hide their malicious payload on GitHub Releases, a legitimate Microsoft-owned service. This technique allows the spyware traffic to blend in with normal software updates. The campaign remains active till May this year, according to researchers at Cyble Research and Intelligence Labs (CRIL).
Malicious LNK File Triggers Fileless Infection Chain
The attack begins with phishing emails that contain a RAR archive file. Inside this archive sits a malicious Windows shortcut file with hidden code, which PowerShell extracts and runs directly in system memory.
This approach uses an anti-sandbox method that keeps the malware inactive during automated security scans. The malicious code only executes when the original file exists on disk, making the threat appear clean to testing tools. Security researchers explained that this deliberate design helps the spyware evade detection.
To avoid raising victim suspicion, the malware opens a decoy PDF document titled ‘Regarding the Provision of Humanitarian Aid.’ The target reads this fake aid form, but the real attack runs silently in the background, while the decoy document comes from a command-and-control server at the IP address 159.198.41.140.
The attack employs a fileless architecture that leaves no executable files on the victim’s hard drive – they hackers host their main payload on GitHub Releases, which makes malicious traffic hard to distinguish from legitimate activity.
Spyware Steals Passwords, Crypto Keys, and Telegram Data
Once inside a system, this malware makes its home in the Windows AppData folder and creates a separate environment for itself to execute from. The developers obfuscate the code using PyArmor version 9.2 Pro, making it challenging for security software to analyze the behavior of the virus.
The primary payload of the malware, known as module.pyw, is a comprehensive surveillance platform with extensive data theft capabilities. The malware first captures usernames, passwords, and session cookies from Chromium-based web browsers such as Chrome, Microsoft Edge, Brave and Opera as well as Yandex – each using their own session data. Also, it will use AES-GCM decryption to acquire stored passwords from Mozilla.
The malware will also attempt to exfiltrate Telegram session data in order for the attacker to gain access to the victim’s active Telegram messaging accounts. It will also scan for any stored cryptocurrencies and private keys in directories on the user’s computer; thus, allowing the attacker direct access to their cryptocurrency digital wallets.
For ongoing monitoring, the implant uses a keyboard logging library to record every keystroke the victim makes. It also captures continuous screenshots using a screen capture library – the malware even installs remote desktop tools like RustDesk or AnyDesk, giving attackers interactive control over infected machines.
Attackers Maintain Persistence Through Scheduled Tasks
The hackers ensure long-term access by registering a Windows Scheduled Task named WindowsHelper. This task executes VBScript launchers that restart the malware every time the system reboots. The command-and-control infrastructure runs on servers hosted by Namecheap, with a Flask backend managing all stolen data.
The attackers frequently update data.zip files on GitHub, indicating an evolving threat. Even though Cyble has not provided information about which group they believe are responsible for this campaign, the types of lures in Russian language and theme of humanitarian assistance indicate to researchers that the group likely consists of Russian-speaking individuals or Governmental entities.
Operation HumanitarianBait illustrates how modern-day cyber-attacks utilize a combination of social engineering, stealth-sophisticated malware designs, and trusted platforms to deliver their malware. By disguising the malicious files as humanitarian assistance documents and then hiding the payloads in legitimate services, the attackers created a surveillance system capable of long-term credential theft.
Although the spyware should be a major concern to Russian-speaking targets and Government-related entities, the HumanitarianBait Campaign is only the next chapter of an ongoing trend of attackers increasingly relying on file-less techniques, code obfuscation, and using legitimate infrastructures to enable their continued activity and evolution.
This evolution includes a move away from traditional dark web platforms. Cybercriminals are shifting to Telegram as dark web crackdowns intensify, making messaging apps the new frontier for malicious activity.
