🧰 PyInstaller

The items that name it 3

• HEAVYGRAM: A Telegram-based Surveillance Backdoor Linked to Handala Hack
  writeup2026-09-17

  Used to compile the HEAVYGRAM Python-based second-stage persistent implant.

• Malicious Code in Open Source: How to Detect It Before You Ship | Blog | Endor Labs
  article2026-09-11

  Used to create the Windows executable that hid obfuscated Python code in the Whatfuscator attack.

• Socket: 11 Malicious NuGet Tools Pose as Game Cheats
  writeup2026-07-15

  Packaging framework used to bundle the pepesoft.exe Python payload