InfraGuard

Red team infrastructure tracker and C2 redirector -- a modern alternative to RedWarden. InfraGuard sits between the internet and your C2 teamserver, validating every inbound request against your malleable C2 profile and blocking anything that doesn't conform. Scanners, bots, and blue team probes...

PhantomFS

Fake Files. Real Security. Virtual honeypot file system for Windows — lure attackers into a directory that looks real, then catch them in the act. What Is PhantomFS? PhantomFS uses the Windows Projected File System ProjFS to surface a virtual directory full of convincing decoy files — financial...

magnet

Magnet Draw the Signals, Detect the Threats. Abstract Magnet is Purple-team telemetry & simulation toolkit. Purpose: modular, cross-platform eventually generator for telemetry and malicious activity. Why the name? Because this attracts SOC analysts and detection rules! 😜 As a secondary use case,...

Dejavu

DejaVU - Open Source Deception Platform DejaVu part of Camolabs.io is a deception platform which can be used to deploy decoys on both cloudfor now we support AWS and internal network. This is our presentation at Blackhat Europe where we show how we can leverage Deception to detect common adversar...

Salat-Stealer-Telegram-Proxy-Decoy-C2-Analysis

1. Telegram Proxy Decoy – Camouflage & Evasion When executed, Salat Stealer displays a fully functional Telegram Proxy interface. This decoy serves as a camouflage to trick the user into thinking they are running a legitimate proxy application, while the malware executes its malicious operations...

CVE-2025-8088

CVE-2025-8088 PoC Educational Use Only Details about this CVE can be found at: https://nvd.nist.gov/vuln/detail/CVE-2025-8088 ⚠️ Warning: This repository contains a proof-of-concept PoC for CVE-2025-8088. It is intended for educational purposes, research, and lab environments only. Do not use this...

AzureC2Relay

AzureC2Relay AzureC2Relay is an Azure Function that validates and relays Cobalt Strike beacon traffic by verifying the incoming requests based on a Cobalt Strike Malleable C2 profile. Any incoming requests that do not share the profiles user-agent, URI paths, headers, and query parameters, will b...

danfoss-ak-sm-decoy

coldstore — a refrigeration system-manager decoy A second lur...

trappsec

trappsec trappsec is an open-source framework that helps developers detect attackers who probe API business logic. By embedding realistic decoy routes and honey fields that are difficult to distinguish from real API constructs, attackers are nudged to authenticate — converting reconnaissance into...

cyber-decoy

cyber-decoy A containerized network decoy honeypot that advertises SSH , RDP , and SMB , observes every inbound connection with eBPF , and reverse-proxies each session into an isolated decoy container. The design separates two concerns: 1. Observation. An eBPF TC classifier attached to the broker...

jit

JitPass You have API keys and tokens in plaintext on your Mac. Use JitPass to protect them. Download for Mac · brew install jitpass/tap/jitpass · Docs · jitpass.com Free for personal and internal company use · Source-available · No account · No telemetry · Nothing leaves your Mac · Secure Enclave...

beelzebub

Beelzebub Framework runtime di deception Beelzebub è un runtime di deception open-source che distribuisce servizi esca adattivi basati su LLM sui protocolli SSH, HTTP, TCP, TELNET e MCP. Va oltre i semplici honeypot passivi ingaggiando attivamente gli attaccanti in interazioni realistiche,...

Honeypot-for-CVE-2025-59287-WSUS

wsus-decoy Defensive proof of concept decoy for CVE-2025-59287 WSUS. The decoy emulates WSUS web endpoints on ports 8530 and 8531, captures full HTTP request bodies and headers, stores evidence for forensic analysis, and includes a Windows test harness to validate endpoint, file and process...

rtf_exploit_extractor

rtfexploitextractor Script to extract malicious payload and decoy document from CVE-2015-1641 exploit documents usage: rtfexploitextract.py -h -o OUTFILE -d DECOY -l LENGTH -v inputfile inputfile exploit document to examine optional arguments: -h, --help show this help message and exit -o OUTFILE...

Cheap to Hypothesize, Costly to Verify: The Defense Surface of Agentic Vulnerability Discovery

Autonomous LLM agents turn vulnerability discovery into a repository-scale search: they generate many vulnerability hypotheses but can verify only a subset under a finite budget. We show that autonomous vulnerability discovery exhibits a hypothesis-verification asymmetry, where verifying a...

AgentLSD: Evaluating AI Security Agents under Adversarial Task Contamination

AI agents for security inspect web pages, source code, logs, configuration files, and command outputs. These environments may contain deceptive artifacts that influence the agent's behavior. We call this adversarial task contamination. Whereas prompt injection relies on attacker-supplied...

Security Framework for Practical Quantum Key Distribution with Imperfect Devices

Practical quantum key distribution QKD systems inevitably exhibit imperfections in both the source and detector. At the same time, the behavior of these imperfect devices is never exactly known due to characterization uncertainty, parameter fluctuations, and potential influence by an adversary. I...

ShadowNet v11.1.0

Big Thanks to Jesus for making this gain attention! Turn to Jesus before it's too late. : He loves You To even further enhance your privacy and security; Use ShadowNet on your Host OS & Run Whonix in a VM to browse the web. Or you can use GhostBox. Sandboxing tool released by Anti Surveillance...

beelzebub v3.9.1

Beelzebub Deception Runtime Framework Beelzebub is an open-source deception runtime that deploys adaptive, LLM-powered decoy services across SSH, HTTP, TCP, TELNET, and MCP protocols. It goes beyond passive honeypots by actively engaging attackers in realistic interactions, collecting high-fideli...

MAL-2026-14269 Malicious code in novel-suduko (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21725a395742c4e3e10cd14a3c787d7a01d5cea63feec2515310f471d497f8ad The package's postinstall lifecycle script chmods and executes the bundled binary native/hint-linux-amd64 via spawnSyncBIN, , stdio: 'inherit' on eve...