78 matches found
Fritter v1.3
Fritter The evasive cousin of Donut. Fritter is a heavily modified fork of TheWover and Odzhan's Donut shellcode generator. It generates position-independent shellcode for in-memory execution of VBScript, JScript, EXE, DLL, and .NET assemblies, with a focus on evasion and signature resistance. Th...
PolyEngine β Updated!
PolyEngine β Polymorphic PE Packer π¦ PolyEngine is a research-grade, evasive PE packer designed for CTF challenges and low-level Windows security education. It focuses on bypassing EDR and AV heuristics through a layered stack of in-memory execution and obfuscation techniques. This is a side...
Malicious code in turbocalc (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 ae55c7a3030f0ff3493a885460511e83e257b4bd6b3e347136c43518b3bddfa2 During import an obfuscated code starts in-memory functions from a binary blob; after that, it communicates with dockfinancial.lu, the exact behaviour is...
Windows LoadModule / Run Assembly
Load a local or catalog .NET assembly or a remote path into memory via Assembly.Load and invoke Main. Small assemblies embed in one PowerShell call; larger ones stage briefly to %TEMP% then delete. !/usr/bin/env python3 -- coding: utf-8 -- """Run a .NET assembly in-memory on a Windows session...
MAL-2026-6977 Malicious code in rarcore (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 69082900a353e728be770b24c10b27f0f2b7cb9f5ec15179833976447fc6c424 During import, this malicious copy of a legitimate package downloads an encrypted data disguise as an image. It contains an archive with a next-stage script th...
Malicious code in yt-api-dlp (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4710e1aa4fe025aaed51f4958f3b514a6cb950b40069f424c7a5d9a2f85591c Package name yt-api-dlp is a single-token insertion away from the widely-used yt-dlp package, and the tarball contains a near-verbatim copy of the...
Windows Python Meterpreter, Bind TCP
Small Meterpreter stager for Windows - bind TCP requires Python on target !/usr/bin/env python3 -- coding: utf-8 -- """ Windows Python Meterpreter Bind TCP Payload Author: KittySploit Team Version: 2.0.0 This payload creates a small Meterpreter stager that listens on the target, accepts a...
Malicious code in analysis-chart (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1ab4349bcc1e8f4434817d242b136f6e6050d4acb234aa833d81ffd74942066 The package's postinstall hook install-hook.js, invoked via package.json scripts.postinstall fetches an opaque binary 'payload.bin' from...
MAL-2026-6299 Malicious code in analysis-chart (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1ab4349bcc1e8f4434817d242b136f6e6050d4acb234aa833d81ffd74942066 The package's postinstall hook install-hook.js, invoked via package.json scripts.postinstall fetches an opaque binary 'payload.bin' from...
Operation-Molasses
π― OPERATION MOLASSES PEKMEZ Zencefil Efendi's Cyber Dow...
Newly Discovered PowMix Botnet Hits Czech Workers Using Randomized C2 Traffic
Cybersecurity researchers have warned of an active malicious campaign that's targeting the workforce in the Czech Republic with a previously undocumented botnet dubbed PowMix since at least December 2025. "PowMix employs randomized command-and-control C2 beaconing intervals, rather than persisten...
Fileless Multi-Stage Remcos RAT: From Phishing to Memory-Resident Execution
Fileless Multi-Stage Remcos RAT: From Phishing to Memory-Resident Execution By Madhini Muralidharan Β· March 11, 2026 Traditional malware campaigns rely heavily on dropping executable files to diskβartifacts that defenders can scan, quarantine, and analyze with signature-based security tools. Mode...
Windows Python Meterpreter, Reverse TCP
Small Meterpreter stager for Windows - receives stage in memory requires Python on target !/usr/bin/env python3 -- coding: utf-8 -- """ Windows Python Meterpreter Reverse TCP Payload Author: KittySploit Team Version: 2.0.0 This payload creates a small Meterpreter stager that connects back to the...
π Metasploit Web Delivery PHP Proof of Concept
This project presents an advanced proof of concept that emulates the behavior of Metasploit's multi/script/webdelivery module using PHP. The goal is to demonstrate how script-based payload delivery works in a modular and extensible way, without relying directly on Metasploit. The script launches ...
CVE-2017-20201
CCleaner v5.33.6162 and CCleaner Cloud v1.07.3191 32-bit builds contained a malicious pre-entry-point loader that diverts execution from scrtcommonmainseh into a custom loader. That loader decodes an embedded blob into shellcode, allocates executable heap memory, resolves Windows API functions at...
EUVD-2025-33278
CCleaner v5.33.6162 and CCleaner Cloud v1.07.3191 32-bit builds contained a malicious pre-entry-point loader that diverts execution from scrtcommonmainseh into a custom loader. That loader decodes an embedded blob into shellcode, allocates executable heap memory, resolves Windows API functions at...
CVE-2017-20201 CCleaner v5.33.6162 & CCleaner Cloud v1.07.3191 Malicious Backdoor Supply Chain Compromise
CCleaner v5.33.6162 and CCleaner Cloud v1.07.3191 32-bit builds contained a malicious pre-entry-point loader that diverts execution from scrtcommonmainseh into a custom loader. That loader decodes an embedded blob into shellcode, allocates executable heap memory, resolves Windows API functions at...
Malicious Package
Overview github.com/weightycine/replika is a malicious package. This package contains malicious code designed to provide attackers with on-demand remote access to a developer's system or CI/CD environment. The package and some other variants use typosquatting to imitate legitimate packages. Upon...
Malicious Package
Overview github.com/stripedconsu/linker is a malicious package. This package contains malicious code designed to provide attackers with on-demand remote access to a developer's system or CI/CD environment. The package and some other variants use typosquatting to imitate legitimate packages. Upon...
Malicious Package
Overview github.com/wetteepee/hcloud-ip-floater is a malicious package. This package contains malicious code designed to provide attackers with on-demand remote access to a developer's system or CI/CD environment. The package and some other variants use typosquatting to imitate legitimate package...