Freeko

How to install: needed 1. Computer 2. SD card 3. Miko 3 1. Download the apks from here 2. copy them to the sd card 3. Startup miko and hit the three dots 4. Go to settings and then Privacy policy 5. Hold on the text in the policy until you see a menu with the option "Share" 6. Tap share and then...

WFH

Windows Feature Hunter WFH Windows Feature Hunter WFH is a proof of concept python script that uses Frida, a dynamic instrumentation toolkit, to assist in potentially identifying common “vulnerabilities” or “features” within Windows executables. WFH currently has the capability to automatically...

Chimera

Chimera Unlea$ed Tool Background While DLL sideloading can be used for legitimate purposes, such as loading necessary libraries for a program to function, it can also be used for malicious purposes. Attackers can use DLL sideloading to execute arbitrary code on a target system, often by exploitin...

Def1nit3lyN0tAJa1lbr3akTool

Def1nit3lyN0tAJa1lbr3akTool iOS 16.0iOS 16.6.1용 탈옥 도구입니다. 그냥 재미로 만들었습니다. 이 도구는 kfd, kfund, Dopamine과 탈옥 커뮤니티 없이는 불가능했을 것입니다. 빌드 방법 iOS 15.7용으로 빌드하는 경우 basebin/의 모든 하위 디렉터리에서 TRUSTCACHEVERSION=1 make를 실행하고, iOS 16.5용으로 빌드하는 경우 TRUSTCACHEVERSION=2 make를 실행하세요. Xcode로 프로젝트를 컴파일하세요. 먼저 부트스트랩을 다운로드해야 ...

CVE-2025-21420-PoC

CVE-2025-21420 PoC Windows 디스크 정리 도구 권한 상승 취약점 제가 아는 한, 비록 불완전하지만 이 CVE에 대한 첫 번째 PoC입니다. https://nvd.nist.gov/vuln/detail/CVE-2025-21420 https://vulners.com/cve/CVE-2025-21420 우리는 cleanmgr.exe로 DLL 사이드로딩을 수행할 방법을 찾았습니다. root@kitploit: $ cp .\dokan1.dll...

CVE-2026-3796

CVE-2026-3796 QAXウイルス除去ツールの2025年10月22日以前のバージョンにおいて、影響を受けるドライバQKSecureIOImp.sysは、呼び出し元プロセスのイメージに基づいてミニフィルタードライバとの通信を許可するかどうかを判断します。攻撃者は、DLLサイドローディングやプロセスインジェクションなどの手法を通じて正当な呼び出し元プロセスのイメージを偽装し、特定のペイロードを含むメッセージをミニフィルターに送信して、保護されたプロセスなどの任意のプロセスを終了させることができます。 背景...

NimDllSideload

Nim DLL Sideloading 이 저장소는 사이드로딩/프록시 로딩에 사용할 수 있는 Nim DLL을 쉽게 생성할 수 있게 해줍니다. DLL 사이드로딩이 무엇인지 잘 모르신다면 이 블로그 게시물을 살펴보세요. 어떻게 사용하나요? 프록시하려는 정상 DLL또는 여러 DLL을 이 저장소의 build 디렉터리에 넣은 다음 make를 실행하세요. 그러면 out 디렉터리에 두 개의 .dll 파일이 생성됩니다: 무작위 이름을 가진 파일은 함수 호출이 프록시될 원본 DLL입니다. 다른 하나는 페이로드입니다. 사이드로딩이 성공하면 메시지...

evilnotify

EvilNotify CVE-2025-24091을 활용하는 아주 간단한 iOS 앱입니다. 딱히 유용한 건 아니고, 그냥 재미삼아 만든 것입니다. 설치 1. Releases 탭에서 최신 .ipa 파일을 받으세요. 2. LiveContainer 또는 기타 사이드로딩 서비스를 통해 설치하세요. 사용법 사용자 지정 키를 추가하거나 사전 설정된 키를 사용하세요. !NOTE 멋진 키를 발견하면 Discord로 보내주세요. 사전 설정 목록에 추가할 수 있는지 확인해 보겠습니다! 크레딧 insidegui — CVE-2025-24091...

OneDriveUpdaterSideloading

OneDriveUpdater DLL 사이드로딩 이 저장소에는 OneDriveUpdater.exe/OneDriveStandaloneUpdater.exe용 version.dll DLL 사이드로딩을 위한 소스 코드가 포함되어 있습니다. 이 페이로드는 PaloAltoNetworks Unit42의 블로그 게시물에 설명된 서브루틴을 기반으로 합니다. 이 페이로드에 관한 제 블로그 게시물: https://blog.sunggwanchoi.com/recreating-an-iso-payload-for-fun-and-no-profit/ versi...

Sideloading on Android: What it is, why it’s risky, and how to do it more safely

A Google spokesperson announced on Reddit that it has started rolling out the first version of its Advanced Flow, designed to make installing apps from unverified developers safer. Let us explain what sideloading is, why Google Play is not 100% safe, what to look for when you’re sideloading so yo...

CVE-2026-59781

When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the target directory allowed unauthorized users to modify its contents, an attacker could place a malicious DLL that could...

CVE-2026-59781 Improper validation of custom installation directories on Windows could allow installation into locations with unsafe permissions, increasing the risk of DLL sideloading.

When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the target directory allowed unauthorized users to modify its contents, an attacker could place a malicious DLL that could...

CVE-2026-59781

The Zabbix Agent Windows installer did not validate directory permissions during custom-path installation, allowing attackers to drop a malicious DLL that gets loaded by the agent, enabling arbitrary code execution. The fix detects unsafe directories and requires explicit user confirmation before...

EUVD-2026-60742

When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the target directory allowed unauthorized users to modify its contents, an attacker could place a malicious DLL that could...

PT-2026-76964

Name of the Vulnerable Software and Affected Versions Zabbix Agent affected versions not specified Description When installed on Windows in a custom directory, the installer fails to verify if the selected location has secure access permissions. This allows an attacker to place a malicious DLL in...

Signed, sealed, injected: The mechanics of DCRat in 2026

Signed, sealed, injected: The mechanics of DCRat in 2026 By Madhini Muralidharan, Shalaka Patil and Kaushal Sarda · August 13, 2026 Introduction In early 2026, the Trellix Advanced Research Center ARC identified and analyzed an active DarkCrystal RAT DCRat campaign following a critical customer...

China-Nexus JadeProx Uses New TriBack Loader in Government and Healthcare Attacks

An exposed Alibaba Cloud server has revealed a China-nexus operation that Group-IB tracks as JadeProx. The cluster has targeted government, healthcare, and education organizations across Asia and Latin America with a previously undocumented Windows loader called TriBack Loader. Group-IB found the...

HelloNet campaign: new malicious modules launched through the ViPNet update system

UPD 16.07.2026: Added rules to protect companies using our Kaspersky SIEM system, and listed events for developing custom detection rules or conducting threat hunting. UPD 16.07.2026: Added detection of the malicious activity using Kaspersky Managed Detection and Response. UPD 16.07.2026: Added...

Suspected China-Nexus Hackers Use Fake Indian Tax Filing Utility to Deploy DcRAT

A suspected China-nexus threat activity cluster has been observed targeting Indian taxpayers, tax professionals, and corporate finance teams to deliver a remote access trojan designed to steal sensitive data from compromised hosts. The multi-stage campaign, codenamed Operation DragonReturn by...

The SOC Files: ScreenConnect masked as freeware. An inside look at a large-scale campaign

UPD 03.07.2026: added a package of rules and recommendations that help detect the described malicious activity for companies using our Kaspersky SIEM system. Introduction To access compromised systems, threat actors frequently abuse legitimate remote monitoring tools. At first glance, these...