TurkoRat

TELEGRAM VERSION ⚔️ TurkoRat 🛡️ Telegram server: https://t.me/turcoflex Discord server: https://discord.gg/xTsJReFG84 joinnew discord 🌐 〢 Content 📁 Setting up ⚔️ Features 📸 Screenshots 📝 Todo 📜 License ⚠️ Note 📁 〢 Setting Up Install Node.js IMPORTANT: When installing Node.js also install "Tools for...

WTSRM

WTSRM - Writing Tiny Small Reliable Malware demo repository for my corresponding talk. Unhooks all Windows Dlls with \KnownDlls\ No CRT dependencies Small size Low entropy Random string encryption key thus no plaintext strings API hashing Hook detection Walks around hooks for initial unhooking on...

spybrowse

BrowseSpy Asegúrate de cambiar las variables ftp en todo el código; estas variables contienen el nombre de usuario, la contraseña y la dirección IP del servidor FTP que recibe los archivos. Este código hará lo siguiente: 1. Se copiará a sí mismo en el directorio %TMP% y se nombrará ursakta.exe 2...

malware_training_vol1

malwaretrainingvol1 Materiales para el entrenamiento de análisis de malware en Windows volumen 1 🚧 ADVERTENCIA: ¡trabajo en progreso! Se añadirá más material gradualmente. Contenido El objetivo de este entrenamiento es desarrollar la comprensión de diversas técnicas comunes utilizadas por el...

windows-malware-behavioral-analysis

Analisi Comportamentale del Malware con REMnux & FLARE-VM Un'indagine pratica di malware per Blue Team che dimostra come eseguibili Windows sospetti possano essere analizzati in sicurezza all'interno di un laboratorio isolato utilizzando tecniche di analisi comportamentale. Piuttosto che invertir...

MalwareSourceCode

managed by vx-underground | follow us on Twitter | download malware samples at the VXUG/samples page 免責事項： 適用される法律で許容される最大限の範囲において、vx-underground およびコンテンツを vx-underground に提出した関連会社は、間接的、偶発的、特別、結果的、懲罰的損害賠償、または直接間接を問わず発生した利益や収入の損失、データ、使用、のれん、その他の無形資産の損失について、以下の事由に起因する場合、一切の責任を負いません。i...

Windows Malware Detector As a Compound AI System: Trade-Offs in Accuracy, Efficiency, and Adversarial Robustness

Industrial Windows malware detectors are commonly described as Compound AI Systems composed of multiple heterogeneous components, including rule-based mechanisms as well as machine-learning-based static and dynamic analyses. However, due to industrial secrecy and limited public disclosure, the...

TerminalFix looks like ClickFix, but delivers a very different payload

Microsoft has published details about a Windows malware campaign it calls TerminalFix. The social engineering used to infect people is very similar to what we've seen in ClickFix campaigns. A website visitor is presented with a fake Cloudflare CAPTCHA which, when clicked, secretly copies a...

isms-builder v1.37.5.3

ISMS Builder Self-hosted Information Security Management System — open source, no cloud required ⚠️ Security Warning: Fake repositories and copies distributing malware ISMS Builder has no packaged "releases", installers, or downloadable ZIP files — the only legitimate source is this repository,...

MAL-2026-13940 Malicious code in @opezneppelin/contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abe04ec28ed56cb0a253131129df8078d425f8a0c579c439ced9c75b6977a6ab @opezneppelin/contracts is a typosquat of @openzeppelin/contracts. Its postinstall lifecycle script scripts/postinstall.js hex-escapes all module...

isms-builder v1.37.2

ISMS Builder Self-hosted Information Security Management System — open source, no cloud required ⚠️ Security Warning: Fake repositories and copies distributing malware ISMS Builder has no packaged "releases", installers, or downloadable ZIP files — the only legitimate source is this repository,...

Fake popular sites offer a free app, instead take over PCs

A website built to look almost exactly like CNN’s homepage is telling visitors to download "the new CNN app." But it's not CNN’s app, and has nothing to do with the news company. The campaign doesn’t stop at CNN. It also uses fake Stremio and Avast installers hosted on similarly convincing...

Google Password Manager Attacks Could Let Malware Hijack Passkey-Protected Accounts

Malware running as an ordinary user on a Windows machine can sign into a victim's passkey-protected accounts without a fingerprint, a PIN, or anything at all appearing on the victim's screen. Unit 42 detailed three attack paths against Chrome's Google Password Manager cloud authenticator, which i...

Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware

The China-linked cybercrime group behind the use of income tax-related phishing lures targeting Indian taxpayers, tax professionals, and corporate finance teams has been observed using a sophisticated crypter service called Cruciferra. According to a new analysis by Proofpoint, Cruciferra has bee...

isms-builder v1.37.0

ISMS Builder Self-hosted Information Security Management System — open source, no cloud required ⚠️ Security Warning: Fake repositories and copies distributing malware ISMS Builder has no packaged "releases", installers, or downloadable ZIP files — the only legitimate source is this repository,...

EXE-Bench: Ranking the Tradeoffs of AI-Based Windows Malware Detectors for Real-World Usability

Due to the lack of systematic evaluations, we are not yet able to determine which AI-based Windows malware detector to deploy in production, since existing evaluations i differ in terms of data used for both training and testing; ii do not consider temporal analysis to showcase whether models...

“TTF Trap” Phishing Emails Use Fake Font Files to Deliver Windows Malware

An email that appears to contain a shipping document, payment request, or business proposal can infect a Windows…...

A week in security (July 6 – July 12)

Last week on Malwarebytes Labs: This new Windows malware can take over your PC and wipe it clean How mule betting scams recruit ordinary people Two Chrome updates in two days fix critical vulnerabilities How World Cup crypto prediction sites take your money 6.9 million driver’s license numbers...

Malicious Package

Overview github.com/kaleidora/dnsub-scanning-tool is a malicious package. This package contains malicious code and while hile this package might be attempting to impersonate a legitimate DNS/subdomain scanning tool, there is no connection between that valid project and this package, which conceal...

Malicious code in @ibrahim1337/baksen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea195bd44e54cd1051fc279a0e871b02c15eea04f65c80979d756fa767f541b4 Package @ibrahim1337/baksen ships a Windows x64 infostealer toolkit that targets Chromium-family browsers Chrome, Brave, Edge, Opera, Opera GX on the...