RDPCredentialStealer

RDPCredentialStealer RDPCredentialStealer est un implant qui vole les identifiants fournis par les utilisateurs dans RDP en utilisant le hooking d'API avec Detours en C++ Preuve de concept pour le vol d'identifiants Essayons ceci : Tout d'abord, je transfère la DLL du dépôt GitHub vers le chemin...

PXEThief

PXEThief PXEThief هي مجموعة من الأدوات التي تنفذ مسارات الهجوم التي تمت مناقشتها في محاضرة DEF CON 30 بعنوان Pulling Passwords out of Configuration Manager https://forum.defcon.org/node/241925 ضد وظيفة نشر نظام التشغيل في Microsoft Endpoint Configuration Manager أو ConfigMgr، التي لا تزال تُعرف...

fakelogonscreen

FakeLogonScreen FakeLogonScreen هي أداة لتزييف شاشة تسجيل الدخول إلى Windows للحصول على كلمة مرور المستخدم. يتم التحقق من صحة كلمة المرور المُدخلة مقابل Active Directory أو الجهاز المحلي للتأكد من صحتها، ثم يتم عرضها في وحدة التحكم أو حفظها على القرص. يمكن تشغيلها إما ببساطة عن طريق تشغيل ملف .ex...

fb-phisher-python

تصيد فيسبوك المؤلف الأصلي : Arslan Mughal بـ : arjunindia المستودع الأصلي : https://github.com/arslanmughal5566/facebookphishing حول السكريبت : باستخدام هذا السكريبت يمكنك سرقة بيانات تسجيل الدخول إلى فيسبوك باستخدام بعض مهارات الهندسة الاجتماعية. المتطلبات : 1 : Python3.x 2 : Flask لتثبيت Flask...

SSH-Stealer

RunAs-Stealer إمكانية تسجيل ضغطات المفاتيح بذكاء لسرقة بيانات اعتماد SSH بما في ذلك كلمة المرور والمفتاح الخاص الاستخدام تُكتب بيانات الاعتماد المسروقة إلى تدفق log الخاص بـ ADS في المسار C:\Users\Desktop\desktop.ini. للحصول على بيانات الاعتماد، اكتب أمر cmd التالي: root@kitploit: more...

Malicious code in @or-sdk/idw-skill (npm)

npm/@or-sdk/idw-skill is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished b...

Malicious code in @or-sdk/cards (npm)

npm/@or-sdk/cards is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by th...

Malicious code in @or-sdk/content-request (npm)

npm/@or-sdk/content-request is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @or-sdk/event-manager (npm)

npm/@or-sdk/event-manager is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republish...

Malicious code in @onereach/idw-contracts (npm)

npm/@onereach/idw-contracts is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11560 Malicious code in @cacheable/node-cache (npm)

npm/@cacheable/node-cache version 3.1.2 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code linked to the "Miasma" supply chain attack targeting the @redhat-cloud-services npm namespace. A malicious actor compromised the publication pipeline and published versions containing malicious code that includes...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code linked to the "Miasma" supply chain attack targeting the @redhat-cloud-services npm namespace. A malicious actor compromised the publication pipeline and published versions containing malicious code that includes...

Threat Actors Exploit Critical FortiClient EMS Flaw to Deploy Credential Stealer

Threat actors are continuing to exploit a critical, now-patched security flaw impacting FortiClient Endpoint Management Server EMS deployments to deliver a credential-stealing malware family dubbed EKZ Infostealer. "The campaign abused trusted endpoint management infrastructure to deliver malware...

Fake ChatGPT download site infects Windows and Mac users with malware

A convincing fake website is impersonating OpenAI’s ChatGPT download page and infecting visitors with malware designed to steal passwords, browser data, cryptocurrency wallets, and other sensitive information. The site, openew.app, closely mimics OpenAI’s real ChatGPT download experience and offe...

TanStack Unspecified Vulnerability

TanStack contains an unspecified vulnerability that allowed malicious versions of the product to be published to the npm registry to publish credential-stealing malware under a trusted identity...

Laravel-Lang PHP Packages Compromised to Deliver Cross-Platform Credential Stealer

Cybersecurity researchers have flagged a fresh software supply chain attack campaign that has targeted multiple PHP packages belonging to Laravel-Lang to deliver a comprehensive credential-stealing framework. The affected packages include - laravel-lang/lang laravel-lang/http-statuses...

MAL-2026-4604 Malicious code in lynx-keeper-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9cebbf0e6cc5a35eea6e6869d295d072526b6ff7d566c49bc80f15952138cf88 lynx-keeper-cli ships a heavily obfuscated payload in dist/index.js that runs at require time. After a CI-evasion gate that aborts when...

Mini Shai-Hulud Pushes Malicious AntV npm Packages via Compromised Maintainer Account

Cybersecurity researchers have discovered a fresh software supply chain attack campaign that has compromised various npm packages associated with the @antv ecosystem as part of the ongoing Mini Shai-Hulud attack wave. "The attack affects packages tied to the npm maintainer account atool, includin...

Malicious code in @antv/f6-hammerjs (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...