Python-based malware is malicious software written in Python or built around a Python runtime. Attackers may package it into executables, scripts, or installers so it can run on Windows, Linux, or macOS after delivery. Because Python is widely used for automation and administration, a Python payload can sometimes look like ordinary scripting activity at first glance.
It matters in cyber security because it can be easier to develop, modify, and deploy than malware written in lower-level languages. Defenders may see it in spear-phishing chains, malicious attachments, droppers, or loaders that unpack a Python component on the endpoint. Detection often relies on watching for suspicious script execution, embedded interpreters, unusual child processes, and network connections from new or unexpected Python tasks. Good defenses include email filtering, application control, endpoint detection, and restricting the ability to run unknown scripts or packaged interpreters.