TrustTunnel

客户端 · App Store · Play Store 目录 简介 服务端特性 客户端特性 快速开始 端点设置 安装端点 更新端点 端点配置向导 Let's Encrypt 证书生命周期 运行端点 导出客户端配置 客户端设置 安装客户端 更新客户端 客户端配置向导 运行客户端 客户端 另请参阅 路线图 许可协议 简介 TrustTunnel 是一个现代化的开源 VPN 协议，最初由 AdGuard VPN 开发，现在可供任何人使用和审计。 它提供快速、安全、可靠的 VPN 连接，没有常见的权衡。 在设计上，TrustTunnel 流量与常规 HTTPS 流量无法区分，...

NimicStack

NimicStack NimicStack 是使用纯 Nim 实现的调用栈欺骗（Call Stack Spoofing）技术，用于模仿合法程序。整个项目基于 WithSecure Labs 分享的 PoC 编译 你可以使用以下命令直接编译源代码： nim c -d=mingw --app=console --cpu=amd64 -o:NimicStack.exe .\Main.nim 如果遇到 "cannot open file" 错误，你还需要安装所需的依赖： nimble install ptrmath winim 用法 与参考项目一样，NimicStack 可以在打开 LSASS...

mimicry

Mimicry Mimicry Mimicry is a security tool developed by Chaitin Technology for active deception in exploitation and post-exploitation. Active deception can live migrate the attacker to the honeypot without awareness. We can achieve a higher security level at a lower cost with Active deception...

mimicry

拟态防护 Mimicry Mimicry 是由长亭科技自研，用于在exploitation和post-exploitation进行主动欺骗的安全防护工具。 通过主动的欺骗，让攻击者在无感知的情况被转移到蜜罐。无需进行安全强对抗即可取得较好的安全效果。 中文文档 | English 🏠 工作原理 Presentation 视频 🔥 Demo 🕹️ 快速开始 1. 确保机器上正确安装 docker , docker-compose root@kitploit: docker info docker-compose version 2. 安装 蜜罐服务 root@kitploit:...

MalleableC2Profiles

MalleableC2Profiles Malleable C2 profiles for Cobalt Strike version 3.6+ bingsearchgetonly.profile - Bing web search profile, uses GET requests only cnnvideogetonly.profile - MSNBC live video straming profile, uses GET requests only googledrivegetonly.profile - Google Drive document viewer...

TrustTunnel v1.1.0

Clients · App store · Play store Table of Contents Introduction Server Features Client Features Quick start Endpoint setup Install the endpoint Updating the endpoint Endpoint configuration wizard Let's Encrypt certificate lifecycle Running endpoint Export client configuration Client setup Install...

MAL-2026-15534 Malicious code in firestore-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3242d5a15b769961bcc2e6d24747a7da27e2afd293ea83e6b042eceeb4b97de2 package.json declares a single dependency whose value is a bare HTTP URL https://repo.securityctrl.com/firestore-lite rather than a registry version...

MAL-2026-12840 Malicious code in bigops-telephony (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da1b7311c033191d85d0d19c679ac9d453f7517897b57618d0d8977d654daf94 On require'bigops-telephony', index.js loads adapter.js which selects a platform-specific asset path, fetches an opaque binary from one of three...

Malicious code in automatic-octo-invention (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2dfb4e3eedab24e355b6d24db6096e6752563e220d28e83ad2cf213fe49fd89 The package ships an 8.6 MB stripped ELF binary at automaticoctoinvention/claw sha256 f6fe45f8fe9081987505af31f0249021a65b558af514f2e4e37340fb3182805...

Malicious code in syft-acp-atoms (npm)

The syft-acp-atoms package was published to the npm registry by user 'ada8877' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the 'syft-acp' internal/private package naming convention an ACP component library of a target...

Malicious code in cdktn-provider-newrelic (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51996ccf23fd3d3b291f945e2ec88504c93d7e302e183c7633632b8a03d1590d Package name 'cdktn-provider-newrelic' is a single-character edit cdktf→cdktn of HashiCorp's official 'cdktf-provider-newrelic' CDK for Terraform...

SAGE: Scalable Automatic Gating Ensemble for Confident Negative Harvesting in Fraud Detection

Music streaming fraud, where bad actors artificially inflate stream counts to manipulate chart rankings and royalty payments, poses a significant threat to streaming services and legitimate content creators. Traditional fraud detection approaches struggle with a critical challenge: many legitimat...

Malicious code in env-threads (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cfb511e0bf06367ec0341939aa68ee55859344c6ca6cb8d9f55f7e62cdcc8656 Package env-threads impersonates the legitimate dotenv package: its README, repository URL git://github.com/motdotla/dotenv.git, homepage, descriptio...

Masters of Imitation: How Hackers and Art Forgers Perfect the Art of Deception

Unmasking impostors is something the art world has faced for decades, and there are valuable lessons from the works of Elmyr de Hory that can apply to the world of defensive cybersecurity. During the 1960s, de Hory gained infamy as a premier forger, passing off counterfeit masterworks of Picasso,...

Adaptive Detection of Polymorphic Malware: Leveraging Mutation Engines and YARA Rules for Enhanced Security

Polymorphic malware continually alters its structure to evade signature-based defences, challenging both commercial antivirus AV and enterprise detection systems. This study introduces a reproducible framework for analysing eight polymorphic behaviours-junk code insertion, control-flow obfuscatio...

SoK: Security Evaluation of Wi-Fi CSI Biometrics: Attacks, Metrics, and Systemic Weaknesses

Wi-Fi Channel State Information CSI has been repeatedly proposed as a biometric modality, often with reports of high accuracy and operational feasibility. However, the field lacks a consolidated understanding of its security properties, adversarial resilience, and methodological consistency. This...

Deepfake criminals impersonate Marco Rubio to uncover government secrets

Deepfake attacks aren't just for recruitment and banking fraud; they've now reached the highest levels of government. News emerged this week of an AI-powered attack that impersonated US Secretary of State Marco Rubio. Authorities don't know who was behind the incident. A US State Department cable...

MAL-2025-191889 Malicious code in telepycore (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c3dcd0a2a8162a703ef9d7b90566e4c55116a7f4f4d3b8759ca0d2640acd4ee4 Package can only be used requires additional triggering to install a remote executable, ensure it starts on logon and name mimic network service. Though...

Snake Mimics a Spider

This is a fantastic video. Its an Iranian spider-tailed horned viper Pseudocerastes urarachnoides. Its tail looks like a spider, which the snake uses to fool passing birds looking for a meal...

Friday Squid Blogging: More Squid Camouflage Research

Heres a research group trying to replicate squid cell transparency in mammalian cells. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Read my blog posting guidelines here...