pupy

Pupy Installation simple pip3 install pipx pipx ensurepath pipx install git+https://github.com/n1nj4sec/pupy@nextgen pupysh Si vous souhaitez des informations plus détailléesReportez-vous au wiki Installation de développement git clone https://github.com/n1nj4sec/pupy cd pupy git checkout nextgen...

VBA-RunPE

VBA RunPE Description Une implémentation simple mais efficace de la technique RunPE en VBA. Ce code peut être utilisé pour exécuter des exécutables depuis la mémoire de Word ou Excel. Il est compatible avec les versions 32 bits et 64 bits de Microsoft Office 2010 et versions ultérieures. Plus...

Ivy

CE DÉPÔT A ÉTÉ ARCHIVÉ Pour voir la dernière version d'Ivy ou soumettre un problème, référez-vous à https://github.com/Tylous/Ivy. Plus d'informations Si vous souhaitez en savoir plus sur les techniques utilisées dans ce framework ainsi que sur les mesures défensives pour s'en protéger, veuillez...

Remote-DLL-Injection-with-Timer-based-Shellcode-Execution

Удалённая инъекция DLL с выполнением шеллкода на основе таймера Документация обновлена после предыдущей ошибки в заголовке об инъекции процесса! ⚠ Только для образовательных исследований Этот репозиторий содержит исследования в области безопасности только в образовательных целях и только для...

CVE-2022-26923-Powershell-POC

CVE-2022-26923-Powershell-POC Un POC PowerShell pour charger et exécuter automatiquement Certify et Rubeus depuis la mémoire. Comment ça fonctionne ? 1. Charge Certify.exe et Rubeus.exe en mémoire. 2. Scanne la machine cible à la recherche de modèles de certificats mal configurés. plus...

MiniPlasma-Runner

MiniPlasma-Runner Version modifiée de Nightmare-Eclipse/MiniPlasma CVE-2020-17103 adaptée pour une utilisation C2. Le PoC original s'exécute uniquement depuis le disque. Cette version s'exécute entièrement depuis la mémoire via execute-assembly, avec une approche de binaire fractionné pour éviter...

MouseServer-1.7.8.5-RCE

WiFi Mouse Server 1.7.8.5 - RCE An optimized Python 3 Proof-of-Concept PoC exploit for WiFi Mouse Server v1.7.8.5. This script leverages an inherent protocol vulnerability to achieve Remote Code Execution RCE via automated keystroke injection. This version has been explicitly modified and tuned f...

MAL-2026-6977 Malicious code in rarcore (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 69082900a353e728be770b24c10b27f0f2b7cb9f5ec15179833976447fc6c424 During import, this malicious copy of a legitimate package downloads an encrypted data disguise as an image. It contains an archive with a next-stage script th...

Malicious code in yt-api-dlp (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4710e1aa4fe025aaed51f4958f3b514a6cb950b40069f424c7a5d9a2f85591c Package name yt-api-dlp is a single-token insertion away from the widely-used yt-dlp package, and the tarball contains a near-verbatim copy of the...

MAL-2026-6754 Malicious code in yt-api-dlp (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4710e1aa4fe025aaed51f4958f3b514a6cb950b40069f424c7a5d9a2f85591c Package name yt-api-dlp is a single-token insertion away from the widely-used yt-dlp package, and the tarball contains a near-verbatim copy of the...

CVE-2026-52885 Notepad++ TOCTOU: HMAC Checks Disk, Executes from Memory

Notepad++ is a free and open-source source code editor. Prior to 8.9.6.4, NppCommands.cpp checks the HMAC of the on-disk shortcuts.xml at the moment a user command fires Time-of-Check. However, the command payload is taken from the in-memory userCommands vector, which is populated at application...

Malicious code in analysis-chart (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1ab4349bcc1e8f4434817d242b136f6e6050d4acb234aa833d81ffd74942066 The package's postinstall hook install-hook.js, invoked via package.json scripts.postinstall fetches an opaque binary 'payload.bin' from...

MAL-2026-6299 Malicious code in analysis-chart (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1ab4349bcc1e8f4434817d242b136f6e6050d4acb234aa833d81ffd74942066 The package's postinstall hook install-hook.js, invoked via package.json scripts.postinstall fetches an opaque binary 'payload.bin' from...

Operation-Molasses

🍯 OPERATION MOLASSES PEKMEZ Zencefil Efendi's Cyber Dow...

Quasar Linux RAT Steals Developer Credentials for Software Supply Chain Compromise

A previously undocumented Linux implant codenamed Quasar Linux RAT QLNX is targeting developers' systems to establish a silent foothold as well as facilitate a broad range of post-compromise functionality, such as credential harvesting, keylogging, file manipulation, clipboard monitoring, and...

CloudZ RAT potentially steals OTP messages using Pheno plugin

Cisco Talos discovered an intrusion, active since at least January 2026, where an unknown attacker implanted a CloudZ remote access tool RAT and a previously undocumented plugin called "Pheno." According to the functionalities of the CloudZ RAT and Pheno plugin, this was with the intention of...

Newly Discovered PowMix Botnet Hits Czech Workers Using Randomized C2 Traffic

Cybersecurity researchers have warned of an active malicious campaign that's targeting the workforce in the Czech Republic with a previously undocumented botnet dubbed PowMix since at least December 2025. "PowMix employs randomized command-and-control C2 beaconing intervals, rather than persisten...

Fileless Multi-Stage Remcos RAT: From Phishing to Memory-Resident Execution

Fileless Multi-Stage Remcos RAT: From Phishing to Memory-Resident Execution By Madhini Muralidharan · March 11, 2026 Traditional malware campaigns rely heavily on dropping executable files to disk—artifacts that defenders can scan, quarantine, and analyze with signature-based security tools. Mode...

Multi-Stage VOID#GEIST Malware Delivering XWorm, AsyncRAT, and Xeno RAT

Cybersecurity researchers have disclosed details of a multi-stage malware campaign that uses batch scripts as a pathway to deliver various encrypted remote access trojan RATs payloads that correspond to XWorm, AsyncRAT, and Xeno RAT. The stealthy attack chain has been codenamed VOIDGEIST by...

Linux RC4 Packer with In-Memory Execution (x86)

This evasion module packs Linux payloads using RC4 encryption and executes them from memory using memfdcreate for fileless execution. The evasion module works on systems with Linux Kernel 3.17+ due to memfdcreate support. Features: - RC4 encryption with configurable key size - Fileless execution...