InvisibleFerret Malware Now Ships as .pyd and .so Files to Evade Script Detection

Cybersecuritynews •Tushar Subhra Dutta • May 25, 2026

A North Korea-linked hacker group has quietly upgraded one of its most dangerous tools, making it harder for security software to detect. InvisibleFerret, an information-stealing malware tied to the threat actor known as Void Dokkaebi (also tracked as Famous Chollima), has been repackaged into a format that slips past many traditional detection methods. Instead of […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Void Dokkaebi Upgrades InvisibleFerret Malware to Evade Detection The North Korea-linked threat group Void Dokkaebi has enhanced its InvisibleFerret malware by converting it from readable Python scripts to compiled binary modules (.pyd and .so files). This upgrade makes it more challenging for security tools to detect the malware through traditional static analysis methods. Previously, InvisibleFerret was easier to identify due to its script format, but the new delivery method leverages Cython to compile the code, increasing its stealth capabilities. The malware is primarily used for information theft and poses a significant risk to organizations that rely on signature-based detection methods. The campaign marks a notable evolution in the group's tactics, indicating a shift towards more sophisticated malware delivery mechanisms. Security professionals are advised to be vigilant and update their detection capabilities accordingly. 2 sources 73

Extracted Entities

InvisibleFerret Malware Now Ships as .pyd and .so Files to Evade Script Detection

The full story

Extracted Entities

APT Groups (2)

Attack Types (1)

Countries (1)

Malware (1)