New Python-based RAT Uses WebSockets for C2 and Data Exfiltration

The attack commences with a phishing email containing a ZIP archive, which, in turn, harbors two shortcut (.LNK) files that masquerade as front and back side images of a seemingly legitimate U.K. driver's license.