PyStoreRAT spreads via fake GitHub tools using small Python or JavaScript loaders to fetch HTA files and install a modular RAT.
Water Saci and RelayNFC drive advanced Brazil-targeted attacks using WhatsApp worm tactics and real-time NFC payment theft.