Freeko

How to install: needed 1. Computer 2. SD card 3. Miko 3 1. Download the apks from here 2. copy them to the sd card 3. Startup miko and hit the three dots 4. Go to settings and then Privacy policy 5. Hold on the text in the policy until you see a menu with the option "Share" 6. Tap share and then...

CVE-2025-21420-PoC

CVE-2025-21420 PoC Vulnerabilidad de Elevación de Privilegios en la Herramienta de Liberación de Espacio en Disco de Windows Hasta donde sé, aunque incompleto, este es el primer PoC para esta CVE. https://nvd.nist.gov/vuln/detail/CVE-2025-21420 https://vulners.com/cve/CVE-2025-21420 Encontramos u...

Chimera

Chimera Unlea$ed Tool Background While DLL sideloading can be used for legitimate purposes, such as loading necessary libraries for a program to function, it can also be used for malicious purposes. Attackers can use DLL sideloading to execute arbitrary code on a target system, often by exploitin...

WFH

Windows Feature Hunter WFH Windows Feature Hunter WFH is a proof of concept python script that uses Frida, a dynamic instrumentation toolkit, to assist in potentially identifying common “vulnerabilities” or “features” within Windows executables. WFH currently has the capability to automatically...

malware-analysis-fake-hwmonitor

Threat Analysis: Fake HWMonitor DLL Sideloading & Infostealer Campaign ⚠️ DISCLAIMER / ПРЕДУПРЕЖДЕНИЕ This repository is created strictly for educational, defensive, and threat research purposes. It contains technical post-mortem analysis, Indicators of Compromise IoCs, and defensive YARA...

CVE-2026-3796

CVE-2026-3796 En QAX Virus Removal, versión del 2025-10-22 y anteriores, el controlador afectado QKSecureIOImp.sys depende de la imagen del proceso llamador para determinar si se le permite comunicarse con el controlador mini filter. Los atacantes podrían suplantar la imagen de un proceso llamado...

NimDllSideload

Sideloading de DLL en Nim Este repositorio te permite generar fácilmente DLLs de Nim que puedes usar para sideloading/proxy loading. Si no estás familiarizado con lo que es el sideloading de DLL, échale un vistazo a esta entrada de blog. ¿Cómo uso esto? Pon la DLL legítima o varias DLLs a las que...

evilnotify

EvilNotify Una aplicación iOS realmente simple que hace cosas con CVE-2025-24091; No es realmente algo útil, solo por diversión Instalación 1. Obtén la última versión .ipa desde la pestaña Releases 2. Instálala mediante LiveContainer o algún servicio de sideloading Uso Añade claves personalizadas...

OneDriveUpdaterSideloading

OneDriveUpdater DLL Sideloading This repo contains source code for DLL sideloading the version.dll for OneDriveUpdater.exe/OneDriveStandaloneUpdater.exe. The payload is based on the subroutines outlined in the PaloAltoNetworks Unit42's blog post. My blog post regarding this payload:...

Def1nit3lyN0tAJa1lbr3akTool

Def1nit3lyN0tAJa1lbr3akTool Una herramienta de jailbreak para iOS 16.0 a iOS 16.6.1. La creé solo por diversión. Esto no habría sido posible sin kfd, kfund, Dopamine y la comunidad de jailbreak. Cómo compilar Ejecuta TRUSTCACHEVERSION=1 make en cada subdirectorio de basebin/ si estás compilando...

Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix Lures

Threat actors are abusing ChatGPT Custom GPTs to disguise them as legitimate product offerings and direct unsuspecting victims to malicious sites that employ ClickFix lures to deliver malware. Huntress, which observed the activity in late September 2026, said it marks the abuse of yet another...

Hackers Use NeedyMantis to Maintain Long-Term Access in Breached Networks

Hackers have used a malware family called NeedyMantis to maintain long-term access to networks they had already breached, Microsoft said in a technical analysis. The malware has been seen in a small number of targeted intrusions at telecommunications organizations, universities, medical nonprofit...

BambooToken Malware Uses MQTT to Control Windows and Linux Systems

Cybersecurity researchers have disclosed details of a multi-platform campaign that uses the Message Queueing Telemetry Transport MQTT protocol as a communication channel to control Windows and Linux systems. The emerging malware family, codenamed BambooToken , is assessed to be active since at...

TerminalFix looks like ClickFix, but delivers a very different payload

Microsoft has published details about a Windows malware campaign it calls TerminalFix. The social engineering used to infect people is very similar to what we've seen in ClickFix campaigns. A website visitor is presented with a fake Cloudflare CAPTCHA which, when clicked, secretly copies a...

ValleyRAT Backdoor Hides in Signed Adware That Users Add to Antivirus Exclusions

The threat actor known as Silver Fox has been observed distributing the ValleyRAT backdoor disguised as a signed Chinese adware application, running the malware under a trusted process to slip past users who add such software to their antivirus exclusions. Russian cybersecurity vendor Kaspersky...

TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy Reverse-Tunnel Backdoor

Microsoft has disclosed details of a new ClickFix variant, dubbed TerminalFix , that aims to trick users into running a malicious command in Windows Terminal or PowerShell. "While traditional ClickFix campaigns direct victims to the Windows Run dialog, TerminalFix campaigns apply the same techniq...

TerminalFix campaign deploys a reverse tunnel through multistage intrusion

In this article 1. Attack chain overview 2. Mitigation and protection guidance 3. Learn more Microsoft Threat Intelligence has observed a TerminalFix campaign, a variant of ClickFix, targeting organizations across multiple industries. The campaign uses compromised websites to display a fake...

TerminalFix campaign deploys a reverse tunnel through multistage intrusion

In this article 1. Attack chain overview 2. Mitigation and protection guidance 3. Learn more Microsoft Threat Intelligence has observed a TerminalFix campaign, a variant of ClickFix, targeting organizations across multiple industries. The campaign uses compromised websites to display a fake...

Sideloading on Android: What it is, why it’s risky, and how to do it more safely

A Google spokesperson announced on Reddit that it has started rolling out the first version of its Advanced Flow, designed to make installing apps from unverified developers safer. Let us explain what sideloading is, why Google Play is not 100% safe, what to look for when you’re sideloading so yo...

Linux Distros Unpatched Vulnerability : CVE-2026-59781

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access...