VeeamDumper-BOF

Veeam Dumper BOF Un BOF per l'estrazione di credenziali per Veeam Backup and Replication e Veeam One di Stephen Munro e Logan Kroeger di @MWRCyberSec. Il BOF deve essere eseguito in un beacon Admin su un server Veeam One o Veeam Backup and Replication e supporta Cobalt Strike e Outflank C2...

solarflare

solarflare Strumento di dumping delle credenziali per SolarWinds Orion Post sul blog: https://malicious.link/post/2020/solarflare-release-password-dumper-for-solarwinds-orion/ Ringraziamenti a @asolino, @gentilkiwi e @skelsec per avermi aiutato a capire DPAPI. root@kitploit:...

MAL-2026-12513 Malicious code in async-mutex-lock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e195fef439eb6af3d28576857a30030e4bd839406fa36b2f939279743f12188e The package is advertised as a mutex-lock utility but ships none of the documented API no Mutex/lock/unlock. Its sole export, getPlugin in index.js,...

MAL-2026-11123 Malicious code in @yancyyu/agentcli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f6774653f487db8fbb9b40f1c1aba2bf959edffae409445162b0d245a3bedf1 The @yancyyu/agentcli package installs a telemetry worker dist/telemetry-worker.bundle.mjs that is started by agentcli init / agentcli usage start an...

MAL-2026-10925 Malicious code in tilaver-mfa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8713506d95648bc2ee9d15418c356259ca9f1d10fb305fd546e3d38c911aea0e index.js is a heavily obfuscated custom VM-bytecode dispatcher with 0x-style identifiers Windows infostealer that executes on module load. It...

Malicious code in cold-debug-elevator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cae8ef53b42bfe7f208c404e2e973600fa174f41c5a2009814f5f0e892769195 The package presents itself as a debugging utility but its exported API is a browser credential stealer targeting installer-owned secrets. The...