css-the-bomb-inside-your-inbox

CSS: die Bombe in deinem Posteingang Willkommen im Repository. Dieses Repository enthält das gesamte Material für meinen Vortrag „CSS: die Bombe in deinem Posteingang“. Dieses Repository enthält Proof-of-Concept-Code, Testfälle und unterstützendes Material, das ausschließlich für legitime...

0net

0net：Einfache Windows-Fernsteuerungs-Backdoor Einführung： 0net ist ein einfaches Windows-Fernsteuerungs-Backdoor-Programm. Der Client ist in c++ geschrieben und wurde unter vc++6.0 kompiliert. Der Server ist in python geschrieben und kann plattformübergreifend verwendet werden. Das Projekt befind...

BetterBackdoor

BetterBackdoor Um backdoor é uma ferramenta usada para obter acesso remoto a uma máquina. Normalmente, utilitários de backdoor como o NetCat têm duas funções principais: canalizar entrada remota para cmd ou bash e exibir a resposta. Isso é útil, mas também limitado. O BetterBackdoor supera essas...

RunAs-Stealer

RunAs-Stealer Stealer de credenciais do utilitário RunAs que implementa 3 técnicas: Hooking de CreateProcessWithLogonW, Keylogging Inteligente, Depuração Remota Uso Os stealers são executados em um loop while o injetor também no caso de Hooking em segundo plano. Para encerrá-los, use o Gerenciado...

CSS-Keylogging

CSS-Keylogger Chrome-Erweiterung und Express-Server, die die Keylogging-Fähigkeiten von CSS ausnutzen. Verwendung Chrome-Erweiterung einrichten 1. Repository herunterladen git clone https://github.com/maxchehab/CSS-Keylogging 2. Rufen Sie chrome://extensions in Ihrem Browser auf oder öffnen Sie d...

JAKEYLOGGER

JAKEYLOGGER Un keylogger ottimo e potente Come installare 'git clone https://github.com/SOHEILTNT/JAKEYLOGGER.git'...

Phoenix-Framework

Phoenix-Framework Phoenix ist ein asynchrones Post-Exploitation-Framework, das vertrauenswürdige Websites für C2 missbraucht. Unterstützte Plattformen Phoenix unterstützt derzeit die folgenden Plattformen über deren Bot-APIs: Discord Telegram Reddit Demnächst Phoenix bietet die folgenden...

SSH-Stealer

RunAs-Stealer Capacità di keylogging intelligente per rubare le credenziali SSH, inclusi password e chiave privata Uso Le credenziali rubate vengono scritte nello stream ADS log di C:\Users\Desktop\desktop.ini. Per ottenere le credenziali, digitare il comando cmd: root@kitploit: more...

BrainDamage

BrainDamage Uno strumento di amministrazione remota basato su Python che utilizza Telegram come server C&C. root@kitploit: /\ /.\ ,.-'/ ",'-., -^ /-^: | \ | \ | | | | | | | | Sviluppato da: Mehul Jain -- Solo per Windows | | | | | | | | | / / | | | | | '/ / | | | | / | | || || | | | /\ \ ||...

TinkererShell

TinkererShell Una semplice reverse shell scritta in Python 3.7 solo per divertimento. Supporta Windows e Linux e integra alcune funzionalità di base come il keylogging e le comunicazioni crittografate AES. Sistemi operativi supportati: Windows Linux OSX Funzioni e caratteristiche: Connessione...

Malicious code in golaaa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43f9a2a9514f30f4def10f6a0a21b4abf4f882fa29a45c6b7c93e96490f49c13 The package's main module cdpinject.js runs on require. It disables TLS certificate verification process-wide...

Malicious code in gcli-control (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8bd4de0b73d7df676127ce8c632117fc7ea8d008bf941fb7d385f67a84f8d67 The package installs and runs a host daemon python -m gcli host that polls a shared JSON document at api.npoint.io for commands, decrypts them,...

Malicious code in aichannel (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e51fdc38d5678b9b9a96014b69db1062b6ecc71b8986a837b4e9ba8d03d7214 Package connects to a hardcoded C2 socket server SOCKETSERVERHOST/SOCKETSERVERPORT from cognikit.config and runs a typed-message session loop that...

OctLurk and SilkLurk: newly identified tailored backdoors in cyber-espionage campaign in Central Asia

Introduction We have been tracking two new backdoors, OctLurk and SilkLurk , observed in attacks against government organizations primarily in Central Asia since January 2025. Identified victims are located in Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and the Syrian Arab...

CVE-2026-67595 VaahCMS 2.0.0 - 2.3.4 Malicious JavaScript Supply Chain via security-otp.blade.php

VaahCMS versions 2.0.0 through 2.3.4 contain a malicious obfuscated JavaScript payload embedded in the Blade template responsible for rendering security OTP emails, allowing remote attackers to execute unauthorized code in any browser that renders the affected email template with JavaScript...

Malicious code in forge-jsx4 (npm)

forge-jsx4 is a remote access trojan RAT published to the public npm registry by the account rafaelsilva [email protected]. Versions 1.0.122 and 1.0.123 were published on June 21-22, 2026 as a reconstitution of the forge-jsx / forge-jsxy campaign, reusing the same command-and-control...

MAL-2026-6279 Malicious code in forge-jsx4 (npm)

forge-jsx4 is a remote access trojan RAT published to the public npm registry by the account rafaelsilva [email protected]. Versions 1.0.122 and 1.0.123 were published on June 21-22, 2026 as a reconstitution of the forge-jsx / forge-jsxy campaign, reusing the same command-and-control...

Malicious code in fastercode (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14de4534d4cf2290f5f54bc5929fa799b73dff2e6a03aa879ade141dfc6ea054 The package advertises itself as a Python performance helper "Make your Python code run faster" and exposes a single public function run. On Windows,...

MAL-2026-5617 Malicious code in sysnu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eac9873e59ffdf79c56fd4f9366b56e0532f87dc00c4380fae18d714785b0bc8 On require / CLI invocation, sysnu performs two install-time-equivalent actions on Windows hosts. First, if python is not on PATH, index.js lines 42-...

MAL-2026-4346 Malicious code in logger-draft (npm)

Part of a multi-package malicious campaign by npm author toskypi, logger-draft is a companion package to eo-terminal in the same infostealer and remote access trojan RAT campaign. Both packages share the same actor, C2 infrastructure, and attack pattern, and are distributed together under a...