evilnotify

EvilNotify CVE-2025-24091을 활용하는 아주 간단한 iOS 앱입니다. 딱히 유용한 건 아니고, 그냥 재미삼아 만든 것입니다. 설치 1. Releases 탭에서 최신 .ipa 파일을 받으세요. 2. LiveContainer 또는 기타 사이드로딩 서비스를 통해 설치하세요. 사용법 사용자 지정 키를 추가하거나 사전 설정된 키를 사용하세요. !NOTE 멋진 키를 발견하면 Discord로 보내주세요. 사전 설정 목록에 추가할 수 있는지 확인해 보겠습니다! 크레딧 insidegui — CVE-2025-24091...

CVE-2025-21420-PoC

CVE-2025-21420 PoC Vulnerabilità di elevazione dei privilegi nello strumento Pulizia disco di Windows Per quanto ne so, sebbene incompleto, questo è il primo PoC per questa CVE. https://nvd.nist.gov/vuln/detail/CVE-2025-21420 https://vulners.com/cve/CVE-2025-21420 Abbiamo trovato un modo per fare...

Chimera

Chimera Unlea$ed Contesto dello strumento Sebbene il DLL sideloading possa essere utilizzato per scopi legittimi, come il caricamento di librerie necessarie al funzionamento di un programma, può anche essere utilizzato per scopi dannosi. Gli aggressori possono utilizzare il DLL sideloading per...

Freeko

Come installare: Occorrente: 1. Computer 2. Scheda SD 3. Miko 3 1. Scarica gli apk da qui 2. copiali sulla scheda SD 3. Avvia Miko e premi i tre puntini 4. Vai nelle impostazioni e poi su Informativa sulla privacy 5. Tieni premuto sul testo dell'informativa finché non vedi un menu con l'opzione...

Def1nit3lyN0tAJa1lbr3akTool

Def1nit3lyN0tAJa1lbr3akTool Uno strumento di jailbreak per iOS 16.0 fino a iOS 16.6.1. L'ho creato solo per divertimento. Questo non sarebbe stato possibile senza kfd, kfund, Dopamine e la community del jailbreak. Come compilare Esegui TRUSTCACHEVERSION=1 make in ogni sottodirectory di basebin/ s...

WFH

Windows Feature Hunter WFH Windows Feature Hunter WFH è uno script Python proof-of-concept che utilizza Frida, un toolkit di strumentazione dinamica, per assistere nell'identificazione potenziale di comuni "vulnerabilità" o "caratteristiche" all'interno degli eseguibili Windows. WFH attualmente h...

CVE-2026-3796

CVE-2026-3796 No QAX Virus Removal, versão datada de 22/10/2025 e anteriores, o driver afetado QKSecureIOImp.sys depende da imagem do processo do chamador para determinar se ele tem permissão para se comunicar com o driver mini filter. Os atacantes poderiam se passar pela imagem de um processo...

NimDllSideload

Nim-DLL-Sideloading Mit diesem Repo kannst du einfach Nim-DLLs erzeugen, die du zum Sideloading/Proxy Loading verwenden kannst. Wenn du nicht weißt, was DLL-Sideloading ist, wirf einen Blick auf diesen Blogbeitrag. Wie benutze ich das? Lege die legitime DLL oder mehrere DLLs, die du als Proxy...

OneDriveUpdaterSideloading

OneDriveUpdater DLL Sideloading Este repositório contém o código-fonte para o sideloading de DLL do version.dll para OneUpdater.exe/OneDriveStandaloneUpdater.exe. O payload é baseado nas sub-rotinas descritas no post do blog da PaloAltoNetworks Unit42. Meu post no blog sobre este payload:...

Sideloading on Android: What it is, why it’s risky, and how to do it more safely

A Google spokesperson announced on Reddit that it has started rolling out the first version of its Advanced Flow, designed to make installing apps from unverified developers safer. Let us explain what sideloading is, why Google Play is not 100% safe, what to look for when you’re sideloading so yo...

CVE-2026-59781

When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the target directory allowed unauthorized users to modify its contents, an attacker could place a malicious DLL that could...

CVE-2026-59781 Improper validation of custom installation directories on Windows could allow installation into locations with unsafe permissions, increasing the risk of DLL sideloading.

When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the target directory allowed unauthorized users to modify its contents, an attacker could place a malicious DLL that could...

EUVD-2026-60742

When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the target directory allowed unauthorized users to modify its contents, an attacker could place a malicious DLL that could...

CVE-2026-59781

The Zabbix Agent Windows installer did not validate directory permissions during custom-path installation, allowing attackers to drop a malicious DLL that gets loaded by the agent, enabling arbitrary code execution. The fix detects unsafe directories and requires explicit user confirmation before...

PT-2026-76964

Name of the Vulnerable Software and Affected Versions Zabbix Agent affected versions not specified Description When installed on Windows in a custom directory, the installer fails to verify if the selected location has secure access permissions. This allows an attacker to place a malicious DLL in...

Signed, sealed, injected: The mechanics of DCRat in 2026

Signed, sealed, injected: The mechanics of DCRat in 2026 By Madhini Muralidharan, Shalaka Patil and Kaushal Sarda · August 13, 2026 Introduction In early 2026, the Trellix Advanced Research Center ARC identified and analyzed an active DarkCrystal RAT DCRat campaign following a critical customer...

HelloNet campaign: new malicious modules launched through the ViPNet update system

UPD 16.07.2026: Added rules to protect companies using our Kaspersky SIEM system, and listed events for developing custom detection rules or conducting threat hunting. UPD 16.07.2026: Added detection of the malicious activity using Kaspersky Managed Detection and Response. UPD 16.07.2026: Added...

Suspected China-Nexus Hackers Use Fake Indian Tax Filing Utility to Deploy DcRAT

A suspected China-nexus threat activity cluster has been observed targeting Indian taxpayers, tax professionals, and corporate finance teams to deliver a remote access trojan designed to steal sensitive data from compromised hosts. The multi-stage campaign, codenamed Operation DragonReturn by...

The SOC Files: ScreenConnect masked as freeware. An inside look at a large-scale campaign

UPD 03.07.2026: added a package of rules and recommendations that help detect the described malicious activity for companies using our Kaspersky SIEM system. Introduction To access compromised systems, threat actors frequently abuse legitimate remote monitoring tools. At first glance, these...

Mustang Panda Hits India and S. Korea with Updated LOTUSLITE Backdoor

Acronis reveals Mustang Panda is using an updated version of LOTUSLITE backdoor to target Indian banks and Korean diplomats. Learn how this DLL sideloading attack works...