camoufox

Camoufox Camoufox 是一款专为网页抓取与 AI 智能体构建的开源反检测浏览器。🦊 ⚠️ 该项目正在开发中。它可能不适合用于稳定的生产环境。⚠️ !NOTE 所有最新文档均可在camoufox.com 获取。 !NOTE 浏览器开发正在 github.com/CloverLabsAI/camoufox 和 github.com/VulpineOS/VulpineOS 进行。 本仓库用于合并检查点版本，应视为主副本。 赞助商 查看/折叠全部 简介 Camoufox 是一个专为网页抓取和 AI 智能体打造的 Firefox...

fingerprint-suite

fingerprint-suite 是一套手工打造的浏览器指纹生成与注入工具。如今的网站越来越多地使用指纹识别技术来追踪和识别用户。借助 fingerprint-suite，你可以生成浏览器指纹并将其注入到浏览器中，让你的爬虫能在不被察觉的情况下运行。 你想和我们一起开发指纹识别工具或类似项目吗？我们正在招聘！ 概述 fingerprint-suite 是一套模块化的浏览器指纹生成与注入工具包。它由以下 npm 包组成，你可以单独使用，也可以组合使用： header-generator：生成可配置、逼真的 HTTP 请求头...

grubcrawler

具备反检测、视觉回退和点对点网格的智能网络爬虫。 端点 · 网格 · 反检测 · Ghost Protocol · 实时流 · MCP 工具 · 快速开始 · 基准测试 · 架构 全栈网络爬虫引擎，支持 JavaScript 渲染、Camoufox 反检测浏览器、每请求代理路由和自主代理循环。通过原生 Rust 提取引擎将页面转换为干净的 Markdown。当常规爬虫被 Cloudflare、验证码或 JavaScript 墙阻挡时，Ghost Protocol 会截取屏幕截图并通过视觉 AI（Claude、GPT-4o 或 Ollama）提取内容。支持单个会话中跨...

azazel

Azazel V 0.1 The whole earth has been corrupted through the works that were taught by Azazel: to him ascribe all sin. -- 1 Enoch 2:8 Azazel is a userland rootkit based off of the original LDPRELOAD technique from Jynx rootkit. It is more robust and has additional features, and focuses heavily...

azazel

Azazel V 0.1 全地はアザゼルによって教えられた業を通して堕落した。すべての罪は彼に帰せよ。 -- 1エノク書2:8 Azazelは、Jynx rootkit由来のオリジナルのLDPRELOAD技術に基づいたユーザーランドルートキットです。より堅牢で追加機能を持ち、アンチデバッグとアンチ検出に重点を置いています。 特徴 アンチデバッグ unhide、lsof、ps、lddの検出を回避 ファイルとディレクトリを隠蔽 リモート接続を隠蔽 プロセスを隠蔽 ログインを隠蔽 PCAPフックによりローカルスニッフィングを防止 2種類のacceptバックドア。 Crypthook...

ProcessHider

ProcessHider 由 M00nRise 创建 重要提示 此工具仅允许用于渗透测试和其他白帽活动。严禁非法使用！ 关于 ProcessHider 是一款后渗透工具，旨在隐藏进程，使其不被任务管理器、Process Explorer 等监控工具发现，从而防止管理员发现 payload 进程。该工具支持 32 位和 64 位系统，能够自动检测操作系统版本并使用相应的工具版本。 ProcessHider 提供 EXE 文件或 Powershell 脚本两种形式。 许可证 此工具采用 BSD-3 许可证： 版权所有 c 2016, M00nRise 保留所有权利。...

cloudscraper

cloudscraper - 增强版 由Zied Boughdir 增强 最新版本：v3.0.0 🚀 - 重大升级 🆕 v3.0.0 的主要新特性 🛡️ 自动 403 错误恢复 - 长时间使用后出现 403 错误时智能刷新会话 📊 会话健康监控 - 主动式会话管理，支持可配置的刷新间隔 🔄 智能会话刷新 - 自动清除 Cookie 并轮换浏览器指纹 🎯 增强隐身模式 - 通过模拟人类行为改进反检测能力 🔧 现代 Python 支持 - 支持 Python 3.8+ 和最新依赖版本 📦 现代打包 - 使用 pyproject.toml 和现代构建工具 🧪 全面测试 -...

browsersploit

This is an advanced browser exploit pack for internal and external pentesting, aiming to gain access to internal computers. The tool is not for script kiddies or non-advanced coders, as it contains bugs and is intended for experienced users. The pack includes various techniques to bypass antiviru...

Vo1d Botnet's Peak Surpasses 1.59M Infected Android TVs, Spanning 226 Countries

Brazil, South Africa, Indonesia, Argentina, and Thailand have become the targets of a campaign that has infected Android TV devices with a botnet malware dubbed Vo1d. The improved variant of Vo1d has been found to encompass 800,000 daily active IP addresses, with the botnet scaling a peak of...

Researchers Expose NonEuclid RAT Using UAC Bypass and AMSI Evasion Techniques

Cybersecurity researchers have shed light on a new remote access trojan called NonEuclid that allows bad actors to remotely control compromised Windows systems. "The NonEuclid remote access trojan RAT, developed in C, is a highly sophisticated malware offering unauthorised remote access with...

Darcula Phishing Network Leveraging RCS and iMessage to Evade Detection

A sophisticated phishing-as-a-service PhaaS platform called Darcula has set its sights on organizations in over 100 countries by leveraging a massive network of more than 20,000 counterfeit domains to help cyber criminals launch attacks at scale. "Using iMessage and RCS rather than SMS to send te...

ExelaStealer A New Entrant in the InfoStealer Landscape

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary ExelaStealer is a newly discovered InfoStealer malware that emerged in August 2023. Its distinctive feature lies in being an open-source tool, customizable for a fee. Primarily coded in Python,...

FormBook Malware Spreads via Malvertising Using MalVirt Loader to Evade Detection

An ongoing malvertising campaign is being used to distribute virtualized .NET loaders that are designed to deploy the FormBook information-stealing malware. "The loaders, dubbed MalVirt, use obfuscated virtualization for anti-analysis and evasion along with the Windows Process Explorer driver for...

Trojanized Windows 10 Installer Used in Cyberattacks Against Ukrainian Government Entities

Government entities in Ukraine have been breached as part of a new campaign that leveraged trojanized versions of Windows 10 installer files to conduct post-exploitation activities. Mandiant, which discovered the "socially engineered supply chain" attack around mid-July 2022, said the malicious I...

This New Fileless Malware Hides Shellcode in Windows Event Logs

A new malicious campaign has been spotted taking advantage of Windows event logs to stash chunks of shellcode for the first time in the wild. "It allows the 'fileless' last stage trojan to be hidden from plain sight in the file system," Kaspersky researcher Denis Legezo said in a technical write-...

Attackers Use Event Logs to Hide Malware

Researchers have discovered a malicious campaign utilizing a never-before-seen technique for quietly planting fileless malware on target machines. The technique involves injecting shellcode directly into Windows event logs. This allows adversaries to use the Windows event logs as a cover for...

A new secret stash for “fileless” malware

In February 2022 we observed the technique of putting the shellcode into Windows event logs for the first time "in the wild" during the malicious campaign. It allows the "fileless" last stage Trojan to be hidden from plain sight in the file system. Such attention to the event logs in the campaign...

Chinese APT Combines Fresh Hodur RAT with Complex Anti-Detection

The Chinese advanced persistent threat APT Mustang Panda a.k.a. Temp.Hex, HoneyMyte, TA416 or RedDelta has upgraded its espionage campaign against diplomatic missions, research entities and internet service providers ISPs – largely in and around Southeast Asia. For one thing, the APT has deployed...

redpill

This is a PowerShell module repository called "redpill" that provides various post-exploitation tools for Windows systems. The repository contains several scripts that can be used to perform different tasks such as: Bypassing AppLocker restrictions Hijacking browser cookies Downloading and...

Lemon Duck Cryptojacking Botnet Changes Up Tactics

The Lemon Duck cryptocurrency-mining botnet has added the ProxyLogon group of exploits to its bag of tricks, targeting Microsoft Exchange servers. That’s according to researchers at Cisco Talos, who said that the cybercrime group behind Lemon Duck has also added the Cobalt Strike attack framework...