Operation Poisson – Analyzing a Cybercriminal’s Entire Operation

Reported 19 Jun 2026 by otx · Severity: medium

A comprehensive analysis of 339 commands issued by a French-speaking threat actor nicknamed 'Poisson' over 33 days, targeting a French automotive small business and four French individuals. The attacker utilized a multi-stage fileless attack deploying a 70-line Python keylogger t