RAT-via-Telegram

RAT-via-Telegram Dviros's notes: Windows Remote Post Breach Tool via Telegram Python 2.7, Originally created by Ritiek, Forked and modified by mvrozanti and then myself. The whole purpose of this tool is to demonstrate as a "PoC" the control of an already breached machine, via Telegram. As the sa...

RAT-via-Telegram

RAT-via-Telegram Windows Remote Administration Tool via Telegram now in Python 3.7! | Originally created by Ritiek Why another one? The current Remote Administration Tools in the market face 2 major problems: Lack of encryption. Require port forwarding in order to control from hundreds of miles...

bt2

bt2: Herramientas de Puerta Trasera de Telegram Blaze bt2 es una puerta trasera basada en Python en forma de un bot de mensajería instantánea que utiliza la infraestructura y la API de bot rica en funciones proporcionada por Telegram, reutilizando ligeramente su plataforma de comunicación para...

Malicious code in sharpnes (crates.io)

sharpnes is a malicious crate published to crates.io on 2026-10-09 by the account crows7781-glitch versions 0.1.0 and 0.1.1, described only as "The sharpnes project is a learn.". It is an infostealer that exfiltrates data to attacker-controlled Telegram bots when the exported async function...

CVE-2026-101050

Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credentialid is absent or secrettoken is empty. Remote unauthenticated attackers can post forged Telegram updates to trigger workflows with the owner's configured credentials and execu...

EUVD-2026-87970

Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credentialid is absent or secrettoken is empty. Remote unauthenticated attackers can post forged Telegram updates to trigger workflows with the owner's configured credentials and execu...

CVE-2026-101050 Heym before 0.0.53 Authentication Bypass via Telegram Webhook

Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credentialid is absent or secrettoken is empty. Remote unauthenticated attackers can post forged Telegram updates to trigger workflows with the owner's configured credentials and execu...

CVE-2026-101050 Heym before 0.0.53 Authentication Bypass via Telegram Webhook

Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credentialid is absent or secrettoken is empty. Remote unauthenticated attackers can post forged Telegram updates to trigger workflows with the owner's configured credentials and execu...

CVE-2026-101050 Heym before 0.0.53 Authentication Bypass via Telegram Webhook

Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credentialid is absent or secrettoken is empty. Remote unauthenticated attackers can post forged Telegram updates to trigger workflows with the owner's configured credentials and execu...

CVE-2026-101050: Improper Authentication

Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credentialid is absent or secrettoken is empty. Remote unauthenticated attackers can post forged Telegram updates to trigger workflows with the owner's configured credentials and execu...

MAL-2026-16214 Malicious code in discord-resolvers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6aa01ed90340a9458c2906ec74fd9277bb7d0e4da48ef09487639aa6c45e6791 The package published as discord-resolvers is unrelated to Discord. On require, index.js invokes startBackupLoop at top level, which recursively...

Malicious code in discord-resolvers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6aa01ed90340a9458c2906ec74fd9277bb7d0e4da48ef09487639aa6c45e6791 The package published as discord-resolvers is unrelated to Discord. On require, index.js invokes startBackupLoop at top level, which recursively...

Malicious code in dotish (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2ccb1a1f0c28d673323f0377c9e65232611641c9de3dbb97f92b17779660b20 The package's postinstall lifecycle script auto-runs on npm install and reads the installer's current working directory .env file typically containin...

Malicious code in bitcoinjs-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8981a1bdc42ac6f595b3805c959060201fc4eb0c39b5bf50b25c5d3d7cc398b5 [email protected] is a typosquat of bitcoinjs-lib that performs credential theft at module load. On require, index.js collects hostname, usernam...

MAL-2026-13258 Malicious code in bitcoinjs-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8981a1bdc42ac6f595b3805c959060201fc4eb0c39b5bf50b25c5d3d7cc398b5 [email protected] is a typosquat of bitcoinjs-lib that performs credential theft at module load. On require, index.js collects hostname, usernam...

Malicious code in @zzzcrypto/xrp-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 781049b09ea0edc63ede63c8c559e3e9a08255982bbe6d18c2e4c0823b4fdf0c Package impersonates the legitimate xrpl library README: 'Drop-in replacement for xrpl'; author field 'XRPLF'; repo points to a non-existent...

MAL-2026-13212 Malicious code in @zzzcrypto/etherjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2aebef684ec4affb6c5d0504179ef4e4f409bf6680cdd6d70772ec8f9b3bf35 @zzzcrypto/etherjs is a typosquat of the popular 'ethers' package. On require, index.js collects the full process.env object along with hostname,...

MAL-2026-12123 Malicious code in @zzzgenesis00/solana-spl-token (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 985d4d8e5069084334daa08512249314d36d9fa8662adef050021c2400dacbdd @zzzgenesis00/[email protected] impersonates the Solana SPL Token package and runs postinstall.js on npm install. The script harvests host...

Malicious code in @wethenorth12/etherjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 723058bc35d3709a0c7e143d8e80357528319cc7b5e508174cd49295eaccb0f8 @wethenorth12/[email protected] is a typosquat of the ethers package package name, description, and author string 'ricmoo' all mimic the real package;...

MAL-2026-12100 Malicious code in @wethenorth12/solana-spl-token (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7dde46db2fbc17fae2957070f85bc43fdb1d265444f2e5adc936faa6f82e96e2 @wethenorth12/solana-spl-token is a typosquat of the legitimate @solana/spl-token package. On module load, index.js collects hostname, username, home...