Deep#Door Stealer Targets Passwords, Tokens, SSH Keys, and Wi

Gbhackers •Mayura Kathir • May 1, 2026

Deep#Door is a stealthy Python-based Remote Access Trojan (RAT) that uses an obfuscated batch loader to deploy a persistent surveillance and credential-stealing implant on Windows systems. It aggressively turns off security controls, hides its traffic behind the bore.]pub tunneling service, and focuses on stealing browser passwords, cloud tokens, SSH keys, and Wi‑Fi credentials. When executed, […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Deep#Door Python Backdoor Targets Windows Systems for Credential Theft Deep#Door is a newly discovered Python-based backdoor targeting Windows systems, identified by Securonix. It employs an obfuscated batch script to deploy a persistent implant capable of long-term surveillance and credential theft. The malware disables Windows security features and uses a public TCP tunneling service to obscure its communications. Key targets include browser passwords, cloud tokens, SSH keys, and Wi-Fi credentials. Deep#Door's stealthy nature allows it to blend malicious activity with legitimate system behavior, complicating detection efforts. It features multiple persistence mechanisms and anti-analysis techniques, making it difficult to remove once installed. The malware can also cause system crashes and overwrite boot records, indicating potential for disruptive attacks. Currently, it poses a significant threat to Windows users, particularly in enterprise environments. 4 sources 67

Extracted Entities

Deep#Door Stealer Targets Passwords, Tokens, SSH Keys, and Wi

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (3)

Platforms (1)