DarkWidow

DarkWidow विंडोज़ को लक्ष्य करने वाला एक अनुकूलन योग्य ड्रॉपर टूल। सम्माननीय उल्लेख: 1. BlackHat Asia, 2024 - टूल्स के लिए कॉल 2. BlackHat USA, 2024 - टूल्स के लिए कॉल 3. BlackHat SecTor, 2024 - टूल्स के लिए कॉल 4. BlackHat Europe, 2024 - टूल्स के लिए कॉल 5. Wild West Hacking Fest 2024 - शस्त्राग...

blenny

Blenny विंडोज़ के लिए एक proof-of-concept पेलोड अस्पष्टीकरण टूल है जो निष्पादन योग्य के आइकन के भीतर निष्पादन योग्य पेलोड डेटा छिपाता है। इसका नाम sabre-toothed blenny fish के नाम पर रखा गया है, जो सफाई करने वाली मछलियों के व्यवहार और रूप की नकल करके बिना सोचे-समझे मछलियों का शिकार करती है। क्यों...

MAL-2026-12469 Malicious code in streak-math-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5ca17a73b4b4b7a21d7ccbad12df26ca3c6ad524689f2e1520bd34724b61fbb On module import, index.js decodes a hex-obfuscated string table to reconstruct a Backblaze B2 URL and a set of Windows filesystem paths, then gates...

MAL-2026-10217 Malicious code in dotnet-runtime-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c10c75766303f8c3bf261487e341e537f103116026309006ab71d977aacdd235 The package's postinstall lifecycle script package.json line 7: "postinstall": "node install.js" runs install.js, which on Windows writes a PowerShel...

MAL-2026-6357 Malicious code in theme-color-picker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7a4ba7e8664b9e1d99c4018963a4731d591653d7f2a9b879ba090e7a7f6e7bd Although the package presents itself as a 'theme color picker', package.json identifies the publisher as analysis-chart.io with repository...

Malicious code in @devcarron/clob (npm)

A campaign of npm packages sharing a common dropper clob.js that downloads and persistently installs a Windows executable from IPFS on postinstall. The dropper fetches the binary from IPFS CID bafybeif3zkapj364ofnrvbty7oj5h5ufpxlp4s62usk3ulxrru35e3gssa via multiple public gateways Pinata,...

Apache CouchDB Erlang Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Apache Couchdb Erlang RCE', 'Description' = %q In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installatio...

Microsoft SharePoint SSI / ViewState Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Microsoft SharePoint Server-Side Include and ViewState RCE', 'Description' = %q This module exploits a server-side include SSI in SharePoint to...

Background Intelligent Transfer Service CVE-2020-0787 - Privilege Escalation

This Metasploit module exploits CVE-2020-0787, an arbitrary file move vulnerability This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Background Intelligent Transfer Service Arbitrary File Move...