What we know
A tool and library for intercepting RDP connections; the documentation describes credential logging and session replay. It can support observation of actors but is not presented as a honeypot.
Evidence limits
These capabilities are documented, not independently verified.
Sources and provenance
- GoSecure/pyrdp repository
repository-documentation · 2026-10-04
Reviewed: 2026-10-04. This record may change when new evidence is found.