Curl Downloading Python to Public Folder (NarwhalRAT Staging)

Duo Tech@duotech

•updated Jun 17, 2026•1•0•6

Detects the use of curl.exe to download the Python embeddable zip file directly into the C:\Users\Public directory, which is indicative of NarwhalRAT staging activity.