ntlm_theft

ntlmtheft 一款用于生成多种类型 NTLMv2 哈希窃取文件的工具。 ntlmtheft 是一个开源的 Python3 工具，可生成 21 种不同类型的哈希窃取文档。这些文档可用于钓鱼攻击，前提是目标允许外部网络的 SMB 流量，或者你已经处于内部网络中。 这些文件类型相较于基于宏的文档或漏洞利用文档的优势在于，它们全部基于“预期功能”构建。2020 年 6 月，Windows Defender 防病毒软件未对其中任何一个进行标记，并且在完全修补的 Windows 10 主机上，21 种攻击中有 17 种成功实施。 ntlmtheft 支持以下攻击类型： 浏览包含文件的文件夹...

Static-Malware-Analysis-Follina-CVE-2022-30190

Análisis-Estático-de-Malware-Follina-CVE-2022-30190 Análisis Estático de Malware de Follina CVE-2022-30190 de Blue Team Labs Online Laboratorio : Blue Team Labs Online – Desafío Follina Tipo de Análisis : Análisis Estático Herramientas Utilizadas : VirusTotal, Explorador de Archivos de Windows...

EUVD-2026-20393

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Elfsight Elfsight WhatsApp Chat CC elfsight-whatsapp-chat allows DOM-Based XSS.This issue affects Elfsight WhatsApp Chat CC: from n/a through = 1.2.0...

CVE-2025-57938

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in themewant Easy Hotel Booking easy-hotel allows DOM-Based XSS.This issue affects Easy Hotel Booking: from n/a through = 1.9.0...

CVE-2025-58631 WordPress IssueM Plugin <= 2.9.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ZEEN101 IssueM issuem allows DOM-Based XSS.This issue affects IssueM: from n/a through = 2.9.0...

PT-2025-5546 · Unknown · Bookingpress

Name of the Vulnerable Software and Affected Versions: BookingPress versions 1.1.25 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for DOM-Based XSS. This means an attacker could potentially inject malicious scripts into...

PT-2024-35343 · Imbachat · Imbachat

Name of the Vulnerable Software and Affected Versions: ImbaChat versions prior to 3.1.4 Description: The issue is related to improper neutralization of input during web page generation, which allows for DOM-Based XSS. This means that an attacker could potentially inject malicious scripts into the...

A week in security (July 12 – July 18)

Last week on Malwarebytes Labs: DNS-over-HTTPS takes another small step towards global domination Nope, that isn’t Elon Musk, and he isn’t offering a free Topmist Dust watch either Four in-the-wild exploits, 13 critical patches headline bumper Patch Tuesday Is crypto’s criminal rollercoaster...

How SMBs Can Mitigate the Growing Risk of File-based Attacks

Cases of document-based malware are steadily rising. 59 percent of all malicious files detected in the first quarter of 2019 were contained in documents. Due to how work is done in today's offices and workplaces, companies are among those commonly affected by file-based attacks. Since small to...

CVE-2018-3982

An exploitable arbitrary write vulnerability exists in the Word document parser of the Atlantis Word Processor 3.0.2.3 and 3.0.2.5. A specially crafted document can prevent Atlas from adding elements to an array that is indexed by a loop. When reading from this array, the application will use an...

Nested, Targeted Attacks Built for Reconnaissance

Researchers say members of the North Atlantic Treaty Organization were targeted during the holidays by a unique document-based attack that evades discovery by lying dormant when it detects a security researcher’s test environment. Characteristics of this attack, according to researchers at Cisco...

Malware Evades Detection with Novel Technique

Researchers have found a new strain of document-based macro malware that evades discovery by lying dormant when it detects a security researcher’s test environment. The malware, according to researcher Caleb Fenton with security firm SentinelOne, evades detection simply by counting the number of...

Locky Ransomware Borrows Tricks from Dridex

It’s been difficult to keep track of all the different strains of ransomware that have plagued users over the last year or two. Unlike many of them the latest to grab headlines is spreading through a decidedly old school vector: document-based macros. Named Locky, the ransomware appears to borrow...