RDPCredentialStealer

RDPCredentialStealer RDPCredentialStealer — это имплант, который перехватывает учетные данные, предоставленные пользователями в RDP, с использованием перехвата API API Hooking с помощью Detours на C++ Инструмент Proof-of-Concept для кражи учетных данных Попробуем это: Сначала я переношу DLL из...

PXEThief

PXEThief PXEThief — это набор инструментов, реализующий атаки, обсуждавшиеся на выступлении DEF CON 30 Извлечение паролей из Configuration Manager https://forum.defcon.org/node/241925 на функциональность развёртывания операционных систем в Microsoft Endpoint Configuration Manager или ConfigMgr,...

fb-phisher-python

Facebook Phishing Оригинальный автор : Arslan Mughal От : arjunindia Оригинальный репозиторий : https://github.com/arslanmughal5566/facebookphishing О скрипте: С помощью этого скрипта вы можете перехватывать данные для входа в Facebook, используя некоторые навыки социальной инженерии. Требования:...

fakelogonscreen

FakeLogonScreen FakeLogonScreen — это утилита для имитации экрана входа в Windows с целью получения пароля пользователя. Введенный пароль проверяется на Active Directory или локальной машине для подтверждения правильности, после чего отображается в консоли или сохраняется на диск. Его можно...

SSH-Stealer

RunAs-Stealer SSH 자격 증명비밀번호 및 개인 키을 탈취하는 스마트 키로깅 기능 사용법 탈취된 자격 증명은 C:\Users\Desktop\desktop.ini ADS log 스트림에 기록됩니다. 자격 증명을 확인하려면 cmd 명령을 입력하세요: root@kitploit: more \Desktop\desktop.ini:log" 저장된 자격 증명을 제거하려면 powershell 명령을 입력하세요: root@kitploit: Remove-Item -Path "C:\Users\d1rk\Desktop\desktop.ini"...

Malicious code in @or-sdk/idw-skill (npm)

npm/@or-sdk/idw-skill is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished b...

Malicious code in @or-sdk/cards (npm)

npm/@or-sdk/cards is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by th...

Malicious code in @or-sdk/content-request (npm)

npm/@or-sdk/content-request is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @or-sdk/event-manager (npm)

npm/@or-sdk/event-manager is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republish...

Malicious code in @onereach/idw-contracts (npm)

npm/@onereach/idw-contracts is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11560 Malicious code in @cacheable/node-cache (npm)

npm/@cacheable/node-cache version 3.1.2 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code linked to the "Miasma" supply chain attack targeting the @redhat-cloud-services npm namespace. A malicious actor compromised the publication pipeline and published versions containing malicious code that includes...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code linked to the "Miasma" supply chain attack targeting the @redhat-cloud-services npm namespace. A malicious actor compromised the publication pipeline and published versions containing malicious code that includes...

Threat Actors Exploit Critical FortiClient EMS Flaw to Deploy Credential Stealer

Threat actors are continuing to exploit a critical, now-patched security flaw impacting FortiClient Endpoint Management Server EMS deployments to deliver a credential-stealing malware family dubbed EKZ Infostealer. "The campaign abused trusted endpoint management infrastructure to deliver malware...

Fake ChatGPT download site infects Windows and Mac users with malware

A convincing fake website is impersonating OpenAI’s ChatGPT download page and infecting visitors with malware designed to steal passwords, browser data, cryptocurrency wallets, and other sensitive information. The site, openew.app, closely mimics OpenAI’s real ChatGPT download experience and offe...

TanStack Unspecified Vulnerability

TanStack contains an unspecified vulnerability that allowed malicious versions of the product to be published to the npm registry to publish credential-stealing malware under a trusted identity...

Laravel-Lang PHP Packages Compromised to Deliver Cross-Platform Credential Stealer

Cybersecurity researchers have flagged a fresh software supply chain attack campaign that has targeted multiple PHP packages belonging to Laravel-Lang to deliver a comprehensive credential-stealing framework. The affected packages include - laravel-lang/lang laravel-lang/http-statuses...

MAL-2026-4604 Malicious code in lynx-keeper-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9cebbf0e6cc5a35eea6e6869d295d072526b6ff7d566c49bc80f15952138cf88 lynx-keeper-cli ships a heavily obfuscated payload in dist/index.js that runs at require time. After a CI-evasion gate that aborts when...

Mini Shai-Hulud Pushes Malicious AntV npm Packages via Compromised Maintainer Account

Cybersecurity researchers have discovered a fresh software supply chain attack campaign that has compromised various npm packages associated with the @antv ecosystem as part of the ongoing Mini Shai-Hulud attack wave. "The attack affects packages tied to the npm maintainer account atool, includin...

Malicious code in @antv/f6-hammerjs (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...