malasada

malasada Donut per Linux, converte un oggetto condiviso ELF di Linux .so in un blob .bin position-independent che può essere eseguito direttamente dalla memoria ad esempio, copiandolo in una regione mmap'd e saltando ad esso come puntatore a funzione. Questo progetto evita intenzionalmente memfd...

DesckVB-RAT

DesckVB RAT v2.9 — RAT .NET Modular, Entrega Multi-Estágio e Ecossistema de Plugins Vínculo da Toolchain a “Pjoao1578” Autor: ShadowOpCode X/Twitter: https://x.com/ShadowOpCode Este repositório acompanha um relatório técnico completo que documenta um ecossistema de malware ativo centrado no Desck...

MouseServer-1.7.8.5-RCE

WiFi Mouse Server 1.7.8.5 - RCE Um exploit de Prova de Conceito PoC otimizado em Python 3 para WiFi Mouse Server v1.7.8.5. Este script aproveita uma vulnerabilidade inerente do protocolo para obter Execução Remota de Código RCE por meio de injeção automatizada de teclas. Esta versão foi...

MoreImpacketExamples

MoreImpacketExamples Este repositório contém alguns scripts curtos em Python criados usando a biblioteca Impacket. O objetivo principal deste projeto é ajudar a mim e a outras pessoas que desejam fazer a transição de usar os exemplos fornecidos do impacket para modificar/criar seus próprios...

EDRSilencer

EDRSilencer Ispirato allo strumento closed source FireBlock FireBlock di MdSec NightHawk, ho deciso di creare la mia versione e questo strumento è stato creato con l'obiettivo di bloccare il traffico in uscita dei processi EDR in esecuzione tramite le API Windows Filtering Platform WFP. Questo...

VBA-RunPE

VBA RunPE Descrizione Un'implementazione semplice ma efficace della tecnica RunPE in VBA. Questo codice può essere utilizzato per eseguire eseguibili dalla memoria di Word o Excel. È compatibile sia con le versioni a 32 bit che a 64 bit di Microsoft Office 2010 e successive. Maggiori informazioni...

zig-pe

zig-pe Reflektiver PE-Lader geschrieben in Zig. Lädt und führt native und .NET PE-Dateien direkt aus dem Speicher aus. Funktionen PE-Ladepipeline DOS- und NT-Header parsen PE32 und PE32+ zur Laufzeit Abschnitte in zugewiesenen Speicher abbilden Importe auflösen Name und Ordinal, PE32 4-Byte / PE3...

MAL-2026-6977 Malicious code in rarcore (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 69082900a353e728be770b24c10b27f0f2b7cb9f5ec15179833976447fc6c424 During import, this malicious copy of a legitimate package downloads an encrypted data disguise as an image. It contains an archive with a next-stage script th...

Malicious code in yt-api-dlp (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4710e1aa4fe025aaed51f4958f3b514a6cb950b40069f424c7a5d9a2f85591c Package name yt-api-dlp is a single-token insertion away from the widely-used yt-dlp package, and the tarball contains a near-verbatim copy of the...

MAL-2026-6754 Malicious code in yt-api-dlp (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4710e1aa4fe025aaed51f4958f3b514a6cb950b40069f424c7a5d9a2f85591c Package name yt-api-dlp is a single-token insertion away from the widely-used yt-dlp package, and the tarball contains a near-verbatim copy of the...

CVE-2026-52885 Notepad++ TOCTOU: HMAC Checks Disk, Executes from Memory

Notepad++ is a free and open-source source code editor. Prior to 8.9.6.4, NppCommands.cpp checks the HMAC of the on-disk shortcuts.xml at the moment a user command fires Time-of-Check. However, the command payload is taken from the in-memory userCommands vector, which is populated at application...

Malicious code in analysis-chart (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1ab4349bcc1e8f4434817d242b136f6e6050d4acb234aa833d81ffd74942066 The package's postinstall hook install-hook.js, invoked via package.json scripts.postinstall fetches an opaque binary 'payload.bin' from...

MAL-2026-6299 Malicious code in analysis-chart (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1ab4349bcc1e8f4434817d242b136f6e6050d4acb234aa833d81ffd74942066 The package's postinstall hook install-hook.js, invoked via package.json scripts.postinstall fetches an opaque binary 'payload.bin' from...

Operation-Molasses

🍯 OPERATION MOLASSES PEKMEZ Zencefil Efendi's Cyber Dow...

Quasar Linux RAT Steals Developer Credentials for Software Supply Chain Compromise

A previously undocumented Linux implant codenamed Quasar Linux RAT QLNX is targeting developers' systems to establish a silent foothold as well as facilitate a broad range of post-compromise functionality, such as credential harvesting, keylogging, file manipulation, clipboard monitoring, and...

CloudZ RAT potentially steals OTP messages using Pheno plugin

Cisco Talos discovered an intrusion, active since at least January 2026, where an unknown attacker implanted a CloudZ remote access tool RAT and a previously undocumented plugin called "Pheno." According to the functionalities of the CloudZ RAT and Pheno plugin, this was with the intention of...

Newly Discovered PowMix Botnet Hits Czech Workers Using Randomized C2 Traffic

Cybersecurity researchers have warned of an active malicious campaign that's targeting the workforce in the Czech Republic with a previously undocumented botnet dubbed PowMix since at least December 2025. "PowMix employs randomized command-and-control C2 beaconing intervals, rather than persisten...

Fileless Multi-Stage Remcos RAT: From Phishing to Memory-Resident Execution

Fileless Multi-Stage Remcos RAT: From Phishing to Memory-Resident Execution By Madhini Muralidharan · March 11, 2026 Traditional malware campaigns rely heavily on dropping executable files to disk—artifacts that defenders can scan, quarantine, and analyze with signature-based security tools. Mode...

Multi-Stage VOID#GEIST Malware Delivering XWorm, AsyncRAT, and Xeno RAT

Cybersecurity researchers have disclosed details of a multi-stage malware campaign that uses batch scripts as a pathway to deliver various encrypted remote access trojan RATs payloads that correspond to XWorm, AsyncRAT, and Xeno RAT. The stealthy attack chain has been codenamed VOIDGEIST by...

Linux RC4 Packer with In-Memory Execution (x86)

This evasion module packs Linux payloads using RC4 encryption and executes them from memory using memfdcreate for fileless execution. The evasion module works on systems with Linux Kernel 3.17+ due to memfdcreate support. Features: - RC4 encryption with configurable key size - Fileless execution...