A sophisticated Python-based malware deployment uncovered during a fraud investigation has revealed a layered attack involving obfuscation, disposable infrastructure and commercial offensive tools. The discovery was made by the Secuinfra Falcon Team after a user reported unusual desktop behaviour and unauthorised PayPal transfers. The case began when the victim noticed "strange black windows" appearing briefly on screen and captured screenshots. Those images showed fragments of a command script that had failed to fully suppress its output, exposing evidence of payload decoding and execution. Initial Infection and PowerShell Activity Secuinfra investigated the compromised system. Logs revealed repeated use of PowerShell commands configured to run in hidden mode with execution policy…