RedTeamCoin

RedTeamCoin RedTeamCoin 是一个基于区块链的加密货币矿池实现，专为授权的安全测试和红队行动设计。它使用 Go 语言构建，支持 Java 客户端，能够模拟真实的加密货币挖矿攻击，帮助组织评估其检测能力并量化威胁行为者挖矿活动可能造成的潜在损害。 该工具使安全团队能够在受控环境中，使用隔离的非公开区块链，安全合法地演示企业系统上的加密货币挖矿攻击场景，生成全面的影响报告，并验证安全控制措施。 目录 概述 功能特性 快速开始 工作原理 用法 运行服务器 运行矿工 连接远程服务器 GPU 挖矿 配置 API 参考 架构 开发 贡献 故障排除 文档 许可协议 致谢 概述...

Cryptocurrency Widgets Pack <= 1.8.1 - SQL Injection

Cryptocurrency Widgets Pack Plugin =1.8.1 for WordPress contains an unauthenticated SQL injection caused by unsanitized user input in database queries, letting attackers execute arbitrary SQL commands, exploit requires no authentication. id: CVE-2022-44588 info: name: Cryptocurrency Widgets Pack ...

ESXi_ransomware_bitcoinWallets

背景 https://blog.ovhcloud.com/ransomware-targeting-vmware-esxi/ https://twitter.com/ValeryMarchive/status/1621528499315150849 勒索信示例： 受害者（目前） 已使用的钱包（目前）1. 1N8v8sRa2RdYq4xUUwpEePFT34TMzesPUx 2. 15vx9oDSQTJuAoYCL1VwzVBDgKYexRHpyC 3. 15KehiyPFC6uSTu4JM7B6fEhstXbCHKQna 4...

coffeeMiner

CoffeeMiner 在WiFi网络中的协作式（mitm）加密货币挖矿池 警告：本项目仅供学术/研究使用。 关于该项目的博客文章可在此阅读：http://arnaucode.com/blog/coffeeminer-hacking-wifi-cryptocurrency-miner.html 概念 对所有选定的受害者执行MITM攻击 在所有受害者请求的HTML页面中注入一个js脚本 注入的js脚本包含一个加密货币矿工 所有连接到局域网（LAN）的受害设备都将为CoffeeMiner进行挖矿 使用 install.sh bash install.sh 编辑...

CVE-batdappboomx

CVE ID CVE-2022-27134 产品 batdappboomx 是一个运行在 EOSIO 区块链 上的公开智能合约。该智能合约向参与者奖励加密货币，但前提是他们需要事先支付一些加密货币。 版本 该智能合约的最新版本。智能合约的 SHA256 哈希值为 1327c04cf4b56183eddb1a897bbebf5a873d3421272b708829a4ed0765bef820 可在区块浏览器 https://bloks.io/account/batdappboomx 查看。 问题类型 访问控制漏洞 描述 batdappboomx 并非开源，但我们通过 WASAI...

RansomCoinPublic

RansomCoin 从勒索软件中提取元数据和硬编码的攻击指标（IoC），以可扩展、高效的方式实现，并集成了 Cuckoo。理想情况下，它在 Cuckoo 动态分析期间运行，但也可用于对大量勒索软件进行静态分析。设计目标为快速、低误报率（针对加密货币地址）。对电子邮件、URL、Onion 地址和域名存在有限的误报（这些很难做到完美）。 简而言之，如果您只关心货币化向量，这是一个快速且简单的初始分类工具。 安装说明 请确保您已安装 Python3。 在 Linux 虚拟机中 建议下载并安装一个虚拟机软件，例如 VirtualBox。安装您所需的 Linux 虚拟机（如 Lubuntu、Ka...

RansomLook

RansomLook RansomLook 是一款用于监控勒索软件组织与市场并提取其受害者的工具。 功能 基于 ransomwatch https://github.com/joshhighet/ransomwatch， 已进行重要更改： 所有数据均存储在 Valkey 中 爬取为多线程 使用 Playwright 进行爬取，并同时截图 解析器现在使用 BeautifulSoup 且相互独立 如果创建本地帐户，则可以通过 Web 界面添加/编辑/删除组 整个网站使用 Flask 构建，因此无需重新生成任何 MD 文件 对包含你的关键字的帖子进行邮件告警 来自 malpedia 的组详细信...

ThreatsDay: AI-Powered Zero-Day Chain, 543K Live Secrets, Model Inspection RCE and 13 More Stories

This week, the useful words are boring ones: inspect, cache, compile, store, trust. Each sounds harmless. Each can become an attack path when a system does a little more than people expect. A model check can run code. A cache can mix up requests. A public secret can stay useful for years. That is...

DriveLife-PsTrojan

DriveLife-PsTrojan TrojanDropper/PS.Maloader.d "驱动人生"病毒 简介 "驱动人生"病毒自2018年出现，至今出现多个变种，不断进行技术优化以躲避安全软件的查杀监测。 该病毒利用永恒之蓝漏洞、SMBGhost漏洞等多种高危漏洞对Windows、Linux下的主机进行入侵感染， 在入侵成功之后不仅会下载挖矿文件进行挖矿，还会释放传播模块继续入侵感染其他终端， 并且病毒所使用的Powershell脚本经过多层混淆用以逃避安全软件的查杀。...

U.S. Disrupts Xinbi Guarantee Scam Marketplace, Freezes $52.8 Million in Crypto

The U.S. Department of Justice DoJ on Wednesday announced coordinated actions aimed at an illicit online marketplace called Xinbi Guarantee that offered scam services, including seizing Telegram channels used to run the service, confiscating two cryptocurrency wallets, and deploying the Scam Cent...

ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2

Cisco Talos is tracking a cryptocurrency-stealing campaign that abuses the Google Visualization API for command and control C2, retrieving obfuscated JavaScript from a publicly published Google Sheets document and injecting it into the victim's browser session. The actors use a variation on...

MAL-2026-15936 Malicious code in trongridew (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 598687794d8452d6845a3529e26bf63838cedee736dc0b8545ad33abe2e827f3 The package exposes a single public function permprivatekey in main.py that unconditionally POSTs the caller-supplied Tron private key as JSON to the...

Malicious code in trongridew (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 598687794d8452d6845a3529e26bf63838cedee736dc0b8545ad33abe2e827f3 The package exposes a single public function permprivatekey in main.py that unconditionally POSTs the caller-supplied Tron private key as JSON to the...

Malicious code in trongridi (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7377339f830834c0b61f370dd642f368374d9551b8b51822d79a902b4b403103 The package exposes a single public function permprivatekey that POSTs the caller-supplied TRON wallet private key as JSON to the hardcoded endpoint...

MAL-2026-15858 Malicious code in trongridi (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7377339f830834c0b61f370dd642f368374d9551b8b51822d79a902b4b403103 The package exposes a single public function permprivatekey that POSTs the caller-supplied TRON wallet private key as JSON to the hardcoded endpoint...

CVE-2026-78391

RansomLook contains a stored cross-site scripting XSS vulnerability in the cryptocurrency wallet detail view. Cryptocurrency addresses and blockchain names originating from external sources, including the public crowd-sourced ransomwhe.re feed, were stored without sufficient validation and later...

EUVD-2026-64891

RansomLook contains a stored cross-site scripting XSS vulnerability in the cryptocurrency wallet detail view. Cryptocurrency addresses and blockchain names originating from external sources, including the public crowd-sourced ransomwhe.re feed, were stored without sufficient validation and later...

CVE-2026-78391

RansomLook contains a stored XSS in its cryptocurrency wallet detail view. Untrusted cryptocurrency addresses and blockchain names—sourced from external feeds such as the public ransomwhe.re crowd-sourcing feed—were stored without sufficient validation and rendered inside an inline JavaScript onc...

CVE-2026-78391 Stored Cross-Site Scripting via Untrusted Cryptocurrency Address Rendering in RansomLook

RansomLook contains a stored cross-site scripting XSS vulnerability in the cryptocurrency wallet detail view. Cryptocurrency addresses and blockchain names originating from external sources, including the public crowd-sourced ransomwhe.re feed, were stored without sufficient validation and later...

CVE-2026-78391 Stored Cross-Site Scripting via Untrusted Cryptocurrency Address Rendering in RansomLook

RansomLook contains a stored cross-site scripting XSS vulnerability in the cryptocurrency wallet detail view. Cryptocurrency addresses and blockchain names originating from external sources, including the public crowd-sourced ransomwhe.re feed, were stored without sufficient validation and later...