SessionHop

SessionHop SessionHop es una herramienta en C que utiliza el objeto COM IHxHelpPaneServer, configurado para ejecutarse como Usuario Interactivo, con el fin de secuestrar sesiones de usuario específicas. Mediante la creación de un moniker de sesión y utilizando la interfaz Execute del objeto COM,...

COM-Hunter

COM-Hunter COM Hijacking VOODOO Descripción COM-Hunter es una herramienta de persistencia mediante COM Hijacking. Disponible tanto en una versión .NET como en una variante BOF totalmente compatible con Cobalt Strike. La siguiente lista explica los modos disponibles: Modo Búsqueda : Busca CLSIDs...

WFH

Windows Feature Hunter WFH Windows Feature Hunter WFH es un script de Python de prueba de concepto que utiliza Frida, un conjunto de herramientas de instrumentación dinámica, para ayudar a identificar potencialmente "vulnerabilidades" o "características" comunes en ejecutables de Windows. WFH...

ContextMenuHijack

ContextMenuHijack This original idea that inspired me is from @NinjaParanoid : ContextMenuHijack is a simple persistence technique that use COM hijacking based on human behavior, when you right click on a file/folder in the File Explorer to open the Context Menu, it executes at the same time the...

invoker

Invoker Utilidad de pruebas de penetración y herramienta de evaluación antivirus. Construido con Visual Studio Community 2022 v17.5.4 64 bits y probado en Windows 10 Enterprise OS 64 bits. Hecho con fines educativos. ¡Espero que sea de ayuda! Este repositorio comenzó a tener firmas conocidas y no...

Spartacus

!CAUTION Este repositorio no tiene mantenimiento, visita https://github.com/sadreck/Spartacus para la versión más reciente. Spartacus: Kit de Secuestro de DLL/COM ¿Por qué "Spartacus"? Si has visto la película Spartacus de 1960, recordarás la escena donde los romanos piden que Spartacus se...

acCOMplice

acCOMplice Your COM hijacking accomplice Author: David Tulis @kafkaesqu3 Overview This repository contains code samples and proofs-of-concept for exploring COM hijacking. COM hijacking is a Windows post exploitation technique, which can be used for persistence or defense evasion. For more...

CVE-2026-66804

CVE-2026-66804: Cross Device Virtual Camera EoP Independently discovered and reported the issue now tracked as CVE-2026-66804. MSRC confirmed the submission as a duplicate of an earlier report with the same underlying Windows Camera FrameServer root cause. A standard Windows user can create a...

Argamal: Malware hidden in hentai games

In April 2026, we discovered a new malware campaign targeting players of "hentai" games. Once launched, the infected games install a previously unknown malicious implant on the user's machine. After a few days, the implant downloads and executes a Trojan, resulting in full system compromise and...

Symantec Endpoint Protection Client < 14.3 RU8 Patch 3 / 14.3 RU9 Patch 2 / 14.3 RU10 Patch 1 Multiple Vulnerabilities (36774)

The version of Symantec Endpoint Protection SEP Client installed on the remote host is affected by a multiple vulnerabilities as referenced in the 36774 advisory. - Symantec Endpoint Protection, prior to 14.3 RU10 Patch 1, RU9 Patch 2, and RU8 Patch 3, may be susceptible to a Elevation of Privile...

CVE-2025-13919

Symantec Endpoint Protection, prior to 14.3 RU10 Patch 1, RU9 Patch 2, and RU8 Patch 3, may be susceptible to a COM Hijacking vulnerability, which is a type of issue whereby an attacker attempts to establish persistence and evade detection by hijacking COM references in the Windows Registry...

CVE-2025-13919

Symantec Endpoint Protection, prior to 14.3 RU10 Patch 1, RU9 Patch 2, and RU8 Patch 3, may be susceptible to a COM Hijacking vulnerability, which is a type of issue whereby an attacker attempts to establish persistence and evade detection by hijacking COM references in the Windows Registry...

EUVD-2025-206456

Symantec Endpoint Protection, prior to 14.3 RU10 Patch 1, RU9 Patch 2, and RU8 Patch 3, may be susceptible to a COM Hijacking vulnerability, which is a type of issue whereby an attacker attempts to establish persistence and evade detection by hijacking COM references in the Windows Registry...

CVE-2025-13919

Symantec Endpoint Protection, prior to 14.3 RU10 Patch 1, RU9 Patch 2, and RU8 Patch 3, may be susceptible to a COM Hijacking vulnerability, which is a type of issue whereby an attacker attempts to establish persistence and evade detection by hijacking COM references in the Windows Registry...

CVE-2025-13919 Component Object Model (COM) Hijacking in Symantec Endpoint Protection Windows Client

Symantec Endpoint Protection, prior to 14.3 RU10 Patch 1, RU9 Patch 2, and RU8 Patch 3, may be susceptible to a COM Hijacking vulnerability, which is a type of issue whereby an attacker attempts to establish persistence and evade detection by hijacking COM references in the Windows Registry...

CVE-2025-13919

The CVE-2025-13919 entry concerns Symantec Endpoint Protection Client vulnerabilities, specifically a COM Hijacking issue in Windows where references in the COM registry can be hijacked to establish persistence and evade detection. Affected software is SEP Client versions prior to 14.3 RU10 Patch...

PT-2026-5143

Name of the Vulnerable Software and Affected Versions Symantec Endpoint Protection versions prior to 14.3 RU10 Patch 1 Symantec Endpoint Protection versions prior to 14.3 RU9 Patch 2 Symantec Endpoint Protection versions prior to 14.3 RU8 Patch 3 Description The software may be susceptible to a C...

EUVD-2024-54613

Malicious code in bioql PyPI...

EUVD-2024-47594

Malicious code in bioql PyPI...

CVE-2025-34090

The CVE-2025-34090 entries reveal a local security bypass in Google Chrome related to the AppBound cookie encryption mechanism. Root cause: insufficient validation of COM server paths during inter-process communication allows a low-privilege attacker to hijack the COM CLSID registration used by C...