thanatos

Thanatos Thanatos is a Windows and Linux C2 agent written in rust. Installation To install Thanatos, you will need Mythic set up on a machine. In the Mythic root directory, use mythic-cli to install the agent. root@kitploit: sudo ./mythic-cli install github https://github.com/MythicAgents/thanato...

Mythic

Mythic A cross-platform, post-exploit, red teaming framework built with GoLang, docker, docker-compose, and a web browser UI. It's designed to provide a collaborative and user friendly interface for operators, managers, and reporting throughout red teaming. Check out a series of YouTube videos...

tf-mythic-azure

Terraforming Mythic This project allows operators to set up multiple Mythic C2 servers in Azure. Optionally, Azure CDN redirectors can be created as well. The idea is that you are able to create multiple "projects" that you can manage from this Terraform code. This way, operators can manage the...

fawkes

Fawkes Mythic C2 Agent Fawkes is an entirely vibe-coded Mythic C2 agent. It started as an "I wonder" and has turned into a goal. My goal is to not write a single line of code for this agent, instead, exclusively producing it at a prompt. I originally attempted to write the agent myself, but after...

Mythic-Macro-Generator

Mythic-Macro-Generator Python3 script to generate MS Office macros for launching Mythic JXA payloads. This script generates an Office macro which uses osascript to download and execute the Mythic JXA .js payload. Steps: 1. Set up Mythic C2 server and generate an "apfell" jxa payload note: this...

apfell

Apfell Apfell is a JavaScript for Automation JXA payload for macOS. This version currently supports Mythic 2.3.+ and will update as necessary. It will not work with Mythic 2.2 and lower. How to install an agent in this format within Mythic When it's time for you to test out your install or for...

Medusa

Medusa Medusa is a cross-platform agent compatible with both Python 3.8 and Python 2.7. Installation To install Medusa, you'll need Mythic v3 installed on a remote computer. You can find installation instructions for Mythic at the Mythic project page. From the Mythic install root, run the command...

Nimplant

Deprecated This agent is deprecated as it's only compatible with Mythic 2.1 and the main developer is not able to continue working on it. If somebody wants to make the updates in the python side of things, not nim code to the latest Mythic, we can mark it as not deprecated anymore. Nimplant is a...

lldp

lldp Mythic C2 profile for peer-to-peer communication over IEEE 802.1AB LLDP. C2 data is carried inside Organizationally Specific TLVs Type 127 with a configurable OUI so that frames blend with vendor-specific LLDP extensions on the wire. LLDP is Layer 2 only. Both agents must share a broadcast...

Mystikal

Mystikal Generatore di payload per l'accesso iniziale su macOS Pensato per essere usato con https://github.com/its-a-feature/Mythic Post del blog correlato: https://posts.specterops.io/introducing-mystikal-4fbd2f7ae520 Utilizzo: 1. Installa Xcode sulla macchina di build Richiesto per il pacchetto...

hermes

Hermes Hermes ist ein leichtgewichtiger Linux-Agent, geschrieben in Python, entwickelt für Mythic 3.0 und neuer. Benannt nach Hermes, dem Götterboten – entwickelt für Geschwindigkeit und Diskretion. Funktionen Linux-Unterstützung SOCKS5-Proxy-Unterstützung für Pivoting und laterale Bewegung Mehre...

MAL-2026-10780 Malicious code in data-parser-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e63ddac8a229de35d497a342d918dbf4255d76e932db5ac33f1cf7db1a9e1939 The package's advertised parsexml/parsejson functions invoke an internal checkenvironment routine that, after a host-uptime sandbox-evasion gate 300...

Malicious code in data-parser-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e63ddac8a229de35d497a342d918dbf4255d76e932db5ac33f1cf7db1a9e1939 The package's advertised parsexml/parsejson functions invoke an internal checkenvironment routine that, after a host-uptime sandbox-evasion gate 300...

Malicious code in pylogora (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfecc686b83d148b0b68acd99fe38f484c035c5b9c59fb7623378866e8e307cc pylogora/init.py invokes a at module top level, so any import pylogora triggers the payload. a base64-decodes hidden URLs and filesystem paths,...

MAL-2026-10689 Malicious code in pylogora (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfecc686b83d148b0b68acd99fe38f484c035c5b9c59fb7623378866e8e307cc pylogora/init.py invokes a at module top level, so any import pylogora triggers the payload. a base64-decodes hidden URLs and filesystem paths,...

Malicious code in log-guru (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6da98c6d79df38328235bb1df969316bd484b2a02594f8656772cd9a1e48f16b The typosquatted package installs a Mythic/Poseidon C2 framework beacon and ensures persistence. After installation, the beacon communicates with C2 on...

MAL-2026-10688 Malicious code in log-guru (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6da98c6d79df38328235bb1df969316bd484b2a02594f8656772cd9a1e48f16b The typosquatted package installs a Mythic/Poseidon C2 framework beacon and ensures persistence. After installation, the beacon communicates with C2 on...

bofhound (>=0.4.9, <=0.4.25), mseep-mcpexample (>=0.1.0, <=0.1.3) +1 more potentially affected by CVE-2026-57952 via mythic (>=0.0.38, <=0.2.10)

mythic PYPI version =0.0.38, =0.4.9, =0.1.0, =1.0.1, =1.3.1 Source cves: CVE-2026-57952 Source advisory: SNYK:PYTHON-MYTHIC-17751535...

Incorrect Authorization

Overview mythic is an Interact with Mythic C2 Framework Instances Affected versions of this package are vulnerable to Incorrect Authorization due to a broken permission filter in the payloadbuildstep table, which uses an always-satisfied or condition that bypasses operation-scoped access controls...

bofhound (>=0.4.9, <=0.4.25), mseep-mcpexample (>=0.1.0, <=0.1.3) +1 more potentially affected by CVE-2026-57951 via mythic (>=0.0.38, <=0.2.10)

mythic PYPI version =0.0.38, =0.4.9, =0.1.0, =1.0.1, =1.3.1 Source cves: CVE-2026-57951 Source advisory: SNYK:PYTHON-MYTHIC-17751534...