Deep#Door Stealer Harvests Browser Passwords, Cloud Tokens, SSH Keys, and Wi

Cybersecuritynews •Tushar Subhra Dutta • May 1, 2026

A newly identified Python-based malware known as DEEP#DOOR has surfaced as a serious threat to Windows users, combining a fully-featured backdoor with a powerful credential-stealing engine. What makes this threat especially concerning is how quietly it operates, embedding itself deep inside a compromised system while collecting sensitive data from multiple sources at once. The malware […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Deep#Door Python Backdoor Targets Windows Systems for Credential Theft Deep#Door is a newly discovered Python-based backdoor targeting Windows systems, identified by Securonix. It employs an obfuscated batch script to deploy a persistent implant capable of long-term surveillance and credential theft. The malware disables Windows security features and uses a public TCP tunneling service to obscure its communications. Key targets include browser passwords, cloud tokens, SSH keys, and Wi-Fi credentials. Deep#Door's stealthy nature allows it to blend malicious activity with legitimate system behavior, complicating detection efforts. It features multiple persistence mechanisms and anti-analysis techniques, making it difficult to remove once installed. The malware can also cause system crashes and overwrite boot records, indicating potential for disruptive attacks. Currently, it poses a significant threat to Windows users, particularly in enterprise environments. 4 sources 67

Extracted Entities

Deep#Door Stealer Harvests Browser Passwords, Cloud Tokens, SSH Keys, and Wi

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)