CredPhish

CredPhish is a PowerShell script designed to invoke credential prompts and exfiltrate passwords. It relies on CredentialPicker to collect user passwords, Resolve-DnsName for DNS exfiltration, and Windows Defender's ConfigSecurityPolicy.exe to perform arbitrary GET requests. For a walkthrough, see...

WifiPassword-Stealer

WifiPassword-Stealer Get All Registered Wifi Passwords from Target Computer. INSTALLATION if you are using a python file root@kitploit: pip install smtplib pip install subprocess pip install glob USAGE •Create an account on "https://mailtrap.io/" using a temp mail. •Set your own SMTP USERNAME and...

sleepall

sleepall Trojan based on the CVE-2024-28085 vulnerability https://people.rit.edu/sjf5462/6831711781/wall2272024.txt which is still unpatched anywhere. Essence: bash supports escape codes and we can control the appearance of the line in the terminal. The trojan listens to processes and looks for t...

e013

e013 Un pequeño script VBScript que roba contraseñas WiFi de Windows En el archivo WifiName.txt puedes ver la contraseña de cada wifi guardado disponible en cualquier computadora Windows que soporte VBscript ⚠️ No modifiques el script con el bloc de notas, usa un editor de texto como GNU Emacs,...

CVE-2023-24055

免责声明 此脚本仅用于教育和演示目的。作者不支持也不纵容将此脚本用于任何犯罪或恶意活动，并且只能在获得明确许可并拥有适当授权的情况下使用。 使用此脚本时需谨慎，因为它会修改 KeePass 配置文件并删除所有先前配置的触发器。使用此脚本可能导致意外行为，甚至可能破坏 KeePass 应用程序。请自行承担风险。 简介 此脚本演示了 KeePass 至 2.53 版本（默认安装）中 争议性 的漏洞（CVE-2023-24055）。该漏洞允许拥有 XML 配置文件写入权限的攻击者通过添加导出触发器获取明文密码。请注意，供应商的立场是密码数据库本身并非旨在防范具有该级别本地 PC 访问权限的攻击...

Linux Distros Unpatched Vulnerability : CVE-2026-55856

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, when a Java...

PT-2026-83771

Name of the Vulnerable Software and Affected Versions ZTE ZXDU68 S202 affected versions not specified Description Command injection flaws allow attackers to delete core system runtime files, which leads to the crash and paralysis of the monitoring module. Additionally, attackers can obtain root...

Exploit for CVE-2026-64638

CVE-2026-64638 — XSS2Shell WordPress Pre-Auth Reflected XSS...

EUVD-2026-52660

In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS1 v1.5 padding and other authentication failures, allowing an on-path attacker who captures a victim's Basic128Rsa15-encrypted username token to use repeated unauthenticated...

OctLurk and SilkLurk: newly identified tailored backdoors in cyber-espionage campaign in Central Asia

Introduction We have been tracking two new backdoors, OctLurk and SilkLurk , observed in attacks against government organizations primarily in Central Asia since January 2025. Identified victims are located in Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and the Syrian Arab...

CVE-2026-47840

CVE-2026-47840 concerns LDAP StartTLS with UAA: a network attacker between UAA and its LDAP directory can impersonate the directory using any trusted certificate, harvest LDAP bind passwords and end-user passwords during simple-bind, and return forged group memberships that grant admin scopes. Af...

CVE-2026-47840 - LDAP StartTLS unconditionally disables hostname verification | Cloud Foundry

Severity High CVSS score: 8.3 High CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS score: 7.5 High CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N/RL:O Vendor CloudFoundry Foundation Versions Affected Severity is High unless otherwise noted. UAA All versions prior to v78.13.0...

Pirated PC games are delivering password-stealing malware

A new Windows malware campaign hides inside pirated PC games and modified installers for franchises like Far Cry, Need for Speed, FIFA, and Assassin’s Creed. Researchers estimate that more than 400,000 devices worldwide have been infected, with around 30,000 users in the US. The infection method ...

Reaper macOS Infostealer Abuses Script Editor to Steal Crypto and Passwords

Threat actors are deploying an updated SHub Stealer variant named Reaper that exploits the native macOS Script Editor to bypass OS-level protections and compromise cryptocurrency assets...

Fake BlueWallet steals passwords, accounts, and crypto from Macs

A fake website impersonating BlueWallet a real Bitcoin wallet is targeting Mac users with a simple but effective attack. BlueWallet itself has not been compromised. Instead, cybercriminals have stolen the name and branding of the legitimate Bitcoin wallet to make a malicious download appear...

CVE-2026-25608

CVE-2026-25608 (STER) : The vulnerability involves unencrypted TCP traffic used by STER to transmit data, enabling a Man-In-The-Middle attacker to obtain sensitive information such as passwords, personal data, or authentication tokens. The underlying risk is data confidentiality loss during netwo...

Fake Job Interview Apps Drop JobStealer Malware on Windows and macOS

Hackers are using Fake interview apps to spread JobStealer malware on macOS and Windows to steal crypto wallets, browser data, and passwords...

Bogus Avast website fakes virus scan, installs Venom Stealer instead

A fake website impersonating Avast antivirus is tricking people into infecting their own computers. The site looks legitimate, runs what appears to be a virus scan, and claims your system is full of threats. But the results are fake: when you’re prompted to “fix” the problem, the download you’re...

Fake CleanMyMac Site Uses ClickFix Trick to Install SHub Stealer on macOS

Researchers warn of a fake CleanMyMac site using a ClickFix attack to install SHub Stealer on macOS and steal passwords and crypto wallets...

Fake Claude Code install pages hit Windows and Mac users with infostealers

Attackers are cloning install pages for popular tools like Claude Code and swapping the “one‑liner” install commands with malware, mainly to steal passwords, cookies, sessions, and access to developer environments. Modern install guides often tell you to copy a single command like curl...