toastfix-demo

Demostración de ToastFix Este proyecto demuestra cómo las notificaciones toast de Windows pueden ser utilizadas de manera convincente en ataques de ingeniería social, específicamente usando señuelos estilo ClickFix. Una demo en vivo está disponible aquí ataque más realista: 👉...

recaptcha-phish

reCAPTCHA Phish John Hammond | 13 de septiembre de 2024 Este es un pequeño arnés para recrear el señuelo de ingeniería social y phishing visto recientemente en la naturaleza alrededor de agosto/septiembre de 2024. 🪝 El señuelo en la naturaleza Originalmente visto con la apariencia "Verifica que...

hyperhives-macos-infostealer-analysis

HyperHives macOS Infostealer — Análisis Técnico Completo Inteligencia de amenazas: Infostealer universal binario de macOS basado en Rust entregado a través de un falso proceso de entrevista de trabajo en Wellfound anteriormente AngelList. El operador con el alias "Felix" de "HyperHive" engañó a l...

InfoG

InfoG v2.0 InfoG se pronuncia Info-yi es una herramienta de recopilación de información. Puedes encontrar direcciones IP, detalles de números de teléfono y mucho más. Cómo usar: Primero clona el repositorio: git clonehttps://github.com/Tech-Sec/InfoG.git Cambia tu directorio a la carpeta InfoG: c...

Facebook Marketplace scam uses your name and number

Facebook users are reporting receiving a message with a fake Facebook Marketplace listing that has their name as the seller. It works like this. You receive a message in this case iMessage asking “Is this still available for purchase?” Attached to the message is a fabricated Facebook Marketplace...

New AvisLoader Windows Malware Uses ClickFix Lure and Tox P2P for C2

Varonis Threat Labs discovered AvisLoader, a Windows malware loader that uses the Tox peer-to-peer network for C2 and arrives through a malicious ClickFix lure...

lure

lure Análisis local de binarios Linux. Cero nube. Cero root. Cero coste. lure es una herramienta local de análisis y sandboxing de ELF Linux para investigadores de seguridad, ingenieros inversos y jugadores de CTF. La versión 0.7.1 añade soporte para binarios ARM64 mediante emulación en modo...

lure v0.7.1

lure Local Linux binary analysis. Zero cloud. Zero root. Zero cost. lure is a local Linux ELF analysis and sandboxing tool for security researchers, reverse engineers, and CTF players. Version 0.7.1 adds ARM64 binary support via QEMU user-mode emulation. It provides three complementary workflows:...

lure v0.5.1

lure Local Linux binary analysis. Zero cloud. Zero root. Zero cost. ⚠️ Early development v0.4.0. Core features inspect, run, diff work end to end on x8664 Linux. This is a young project — expect rough edges, limited error handling on unusual inputs, and missing features. Bug reports, feedback, and...

SilkParasite Espionage Campaign Targets Central Asian Governments with Five New RATs

A previously unreported cyber espionage operation dubbed SilkParasite has been observed targeting government bodies in Central Asia. The intrusion set makes use of seven remote access tool RAT families, five of which have never been previously documented: DriveSilkRAT, CookiETagRAT, NomadRAT,...

MAL-2026-13616 Malicious code in hardhat-cap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3d9de53c9b5916edf45f9055ecdb2fbdd0752cfe7779f37c7d294a16788faf8 The package is published as hardhat-cap but its README, LICENSE, index.d.ts, and lib/proto.js / lib/tools.js are a verbatim copy of the pino logger,...

MAL-2026-13553 Malicious code in dolyame-boxy-independent-bnpl-product-grid (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 838978067dbfc6b266e91ac3f0255687d3b31364dfac82c9f992ded8ecd1ef36 On require of index.js, runtime.js selects a platform-specific payload path, rotates through hardcoded Cloudflare Workers hosts...

lure v0.4.0

lure Local Linux binary analysis. Zero cloud. Zero root. Zero cost. ⚠️ Early development v0.4.0. Core features inspect, run, diff work end to end on x8664 Linux. This is a young project — expect rough edges, limited error handling on unusual inputs, and missing features. Bug reports, feedback, and...

Malicious code in commonweb-balance (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7455a26ab96be134244f14c67b9e3fbf63033f1b974cf45ad0620d5a6eda0581 [email protected] is an empty shell package empty index.js, no functionality whose only effect on install is resolving its single declared...

lure v0.3.1

lure Local Linux binary analysis. Zero cloud. Zero root. Zero cost. ⚠️ Early development v0.4.0. Core features inspect, run, diff work end to end on x8664 Linux. This is a young project — expect rough edges, limited error handling on unusual inputs, and missing features. Bug reports, feedback, and...

Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures

A macOS ClickFix operation spanning more than 250 front-end domains now fingerprints visitors before deciding whether to show them a malware lure, a change Microsoft Threat Intelligence tracked on infrastructure it had been watching for weeks. The server-side gate hides the malicious page from...

Malicious code in bip39-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec957684e0430a139485e6eacb410980ada8b9c9e90c0ba3c6909472f1557339 On module load, index.js JSON-serializes the full process.env together with hostname, username, homedir, platform, and cwd, base64-encodes the blob,...

MAL-2026-13257 Malicious code in bip39-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec957684e0430a139485e6eacb410980ada8b9c9e90c0ba3c6909472f1557339 On module load, index.js JSON-serializes the full process.env together with hostname, username, homedir, platform, and cwd, base64-encodes the blob,...

MAL-2026-13195 Malicious code in dolyame-ui-themes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22c23ba8923130746ecc1e526c3a0ee8961ea764dd90d0da71236444d978ce27 dolyame-ui-themes ships a loader.js that is required from the package main index.js at module load. The loader reconstructs C2 hostnames from split...

MAL-2026-12880 Malicious code in bnpl-blocks-atom-bnpl-link-avatar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3be43998de08cea356c696d856d5469ab529293a1899f1beed856d529200413d On require of the package, index.js loads polyfill.js which selects a platform-specific path, downloads an opaque binary over HTTPS from hardcoded...