{
  "$type": "site.standard.document",
  "bskyPostRef": {
    "cid": "bafyreicnmg3orsosmuczgnbugw3wbgiinc7smyrfjc3dprjwgtydiyf4du",
    "uri": "at://did:plc:6wtxqaikjf62unmnajbfbq5v/app.bsky.feed.post/3mn2mdhowvn42"
  },
  "coverImage": {
    "$type": "blob",
    "ref": {
      "$link": "bafkreiarxdqlgehjq44umtt6mkkmq5qs7clh32hquix524z3y4xhfwseza"
    },
    "mimeType": "image/webp",
    "size": 35964
  },
  "path": "/invisibleferret-malware-now-uses-pyd-and-so-files-to-evade-script-based-detection/",
  "publishedAt": "2026-05-28T18:28:46.000Z",
  "site": "https://vpncentral.com",
  "tags": [
    "News",
    "InvisibleFerret malware now uses .pyd and .so files to evade script-based detection",
    "VPN Central"
  ],
  "textContent": "North Korea-linked hackers have updated InvisibleFerret, a malware family used to steal credentials, cryptocurrency wallet data, and developer secrets. The newest version no longer arrives mainly as readable Python scripts. It now ships as Cython-compiled .pyd files on Windows and .so files on macOS. The change makes the malware harder to catch with older detection […]\n\nThe post InvisibleFerret malware now uses .pyd and .so files to evade script-based detection appeared first on VPN Central.",
  "title": "InvisibleFerret malware now uses .pyd and .so files to evade script-based detection"
}