Stealth Browser SDK Cykani Install or Invocation

How the attack works

An agent or a subprocess it launched runs a package-manager command (like pip install) naming 'cykani', or directly imports and runs the module via python -m or python -c. The detection watches process command lines for this exact package name paired with an install or invocation verb. It ignores generic 'stealth' branding in other tools (playwright-stealth, undetected-chromedriver, etc.) so those don't trigger false alarms. Once cykani is running, it could drive a real browser session while resisting bot-detection checks, which is useful for scraping, credential misuse, or bypassing anti-automation defenses on target sites.

Netzilo detection

Why it matters

An organization loses visibility into automated browser sessions that are built specifically to look human, which can be used to bypass login protections, scrape data, or interact with web services in ways that evade normal bot defenses. This rule only confirms the tool arrived and which agent brought it in — it does not by itself prove any harmful action occurred.

What you can do

• →Review why the agent or process introduced this package and whether it matches an approved use case.
• →Correlate this event with subsequent network connections or credential access from the same process to see if the automation was used for something harmful.
• →If evaluation or research is legitimate, document it so it isn't repeatedly flagged as unexplained.
• →Restrict which package indexes and install commands agents are allowed to run, and monitor for install of tools that evade browser-automation detection.

Known benign look-alikes

• Security researcher or malware analyst installing the package inside a sandbox to reproduce and analyse it. Expected and desirable to record; triage by the spawning agent and host.
• Developer legitimately evaluating browser-automation SDKs during a bake-off. Reported, never blocked, so the evaluation is not interrupted.
• Internal mirror or vendored fork of the package installed by a CI job from a private index; the command line is identical to the public install.
• Onboarding scripts or READMEs that print the install command as an example (suppressed by filter_display unless the printed command is piped to a shell).
• Cleanup, inventory or vulnerability-audit commands that name the package (suppressed by filter_readonly).
• NOT a false-positive source, by construction - generic stealth-automation packages (playwright-stealth, undetected-chromedriver, selenium-stealth, puppeteer-extra-plugin-stealth) contain none of the matched tokens and will never fire this rule.

References

• https://attack.mitre.org/techniques/T1195/002/
• https://attack.mitre.org/techniques/T1059/006/