ClickOnceBlobber

Kit di Iniezione AppDomainManager ClickOnce Armare applicazioni ClickOnce .NET firmate per l'accesso iniziale dirottando una DLL di dipendenza tramite iniezione AppDomainManager e caricando una porta C dell'agente ProxyBlob. Include una porta C di ProxyBlob — un proxy SOCKS5 che instrada tutto il...

Microsoft Detects "SesameOp" Backdoor Using OpenAI's API as a Stealth Command Channel

Microsoft has disclosed details of a novel backdoor dubbed SesameOp that uses OpenAI Assistants Application Programming Interface API for command-and-control C2 communications. "Instead of relying on more traditional methods, the threat actor behind this backdoor abuses OpenAI as a C2 channel as ...

ThievingFox - Remotely Retrieving Credentials From Password Managers And Windows Utilities

ThievingFox is a collection of post-exploitation tools to gather credentials from various password managers and windows utilities. Each module leverages a specific method of injecting into the target process, and then hooks internals functions to gather crendentials. The accompanying blog post ca...