monkey

Monkey documentation This folder contains the Monkey Documentation site. For more information see content/development/contribute-documentation.md...

PolinRider

PolinRider: DPRK Threat Actor Implants Malware in Hundreds of GitHub Repos Date: 2026-03-07 Last updated: 2026-04-11 — see April 10–11 Update below Severity: CRITICAL — active supply chain infection across 1,950+ public repositories, confirmed operational merger with the TasksJacker / Contagious...

pict

PICT - 感染後収集ツールキット このスクリプト群は、感染が疑われるエンドポイントからさまざまなデータを収集し、インシデント対応プロセスを支援するために設計されています。このデータは完全なフォレンジックデータ収集と見なされるべきではありませんが、多くの有用なフォレンジック情報を捕捉します。 真のフォレンジックデータが必要な場合は、完全なメモリダンプを取得し、ドライブ全体をイメージ化する必要があります。それはこのツールキットの範囲外です。 使用方法 スクリプトはライブシステム上で実行する必要があり、イメージやその他のフォレンジックデータストア上では実行できません。厳密には実行に roo...

cromos

Cromos Cromos is a tool for downloading legitimate extensions of the Chrome Web Store and inject codes in the background of the application and more cromos create executable files to force installation via PowerShell for example, and also upload files to dropbox to host the malicious files...

UACElevator

UACElevator DLL 감염을 통한 수동적 UAC 권한 상승 셸코드 바이너리는 UACElevator.cpp의 shellcode char 배열에 있으며, 원시 코드는 shellcode.asm에 있습니다...

kwetza

소개 크리스 르 로이@brompwnie [email protected] 작성 Kwetza는 기존 안드로이드 애플리케이션에 Meterpreter 페이로드를 감염시킬 수 있는 도구입니다. 무엇을 하나요? Kwetza는 기존 안드로이드 애플리케이션에 사용자 정의 또는 기본 페이로드 템플릿을 주입하여 안티바이러스 탐지를 회피합니다. Kwetza는 대상 애플리케이션의 기본 권한을 사용하거나 추가 권한을 주입하여 추가 기능을 얻을 수 있도록 합니다. 블로그 포스트는 어디에서 볼 수 있나요? Kwetza가 자동화한 수동 단계는...

cpanel-cve-2026-41940

🔒 cPanel CVE-2026-41940 — 完全なセキュリティツールキット CVE-2026-41940 / nuclear.x86 に感染した cPanel サーバーのための完全なセキュリティツールキット。 2つのスクリプト — 1つはフル監査、もう1つは Imunify360 による自動クリーンアップ。 オリジナルライセンスと bypass / 共有ライセンス — どちらのサーバーでも動作します。 👨‍💻 作者 | ---|--- 名前| MD Mahfuz Reham 役割| システム管理者 | Webホスティングスペシャリスト ウェブサイト| MahfuzReham.Com...

CVE-2021-33831

소개 이 애플리케이션은 독일 감염법에 따라 사람들을 추적하여 Covid-19 감염 사슬을 추적할 수 있도록 하는 데 사용됩니다. 이것은 iCampus라는 학생 프로젝트로 만들어졌으며, 빌다우 대학뿐만 아니라 콧부스-젠프텐베르크에서도 사용됩니다. 약 10,000명의 사람들이 영향을 받고 있습니다. 대학의 손님들은 이 애플리케이션을 사용해야 합니다. 이 애플리케이션은 Vue 프론트엔드와 Laravel 백엔드로 구성되어 있습니다. 백엔드는 대학 손님의 등록을 허용하는 게스트 사용자 등록 엔드포인트...

Dragnmove

Dragnmove Dragnmove は、ユーザー間で共有されるファイルに感染して、あるシステムから別のシステムへ移動するためのポストエクスプロイテーションツールです。Dragnmove は、ブラウザウィンドウへのファイルのドロップや、メールクライアントへのファイル添付などの操作を検出できます。Dragnmove が操作を検出すると、CreateFile API 呼び出しをフックしてハンドルを変更します。 使用方法 作業中!!! 環境に応じて TARGETWINDOW と PAYLOADFILE を変更する Dragnmove を VS2019-VS2022 でコンパイルする...

CVE-2023-6000

CVE-2023-6000 PoC この検出方法の仕組み このテンプレートは次のパスを確認します: /wp-content/plugins/popup-builder/readme.txt 記載されているStable Tagに基づき、バージョンが4.2.3より前の場合、脆弱性があると見なされます。 このスクリプトの実行方法 1. Nucleiをここからダウンロードする 2. テンプレートをローカルシステムにコピーする 3. 次のコマンドを実行する: nuclei -u https://yourHost.com -t template.yaml 参照...

The Odyssey and Trojans again: MovieReaper attacks users in multiple countries through compromised torrents

Introduction Torrent trackers have long been abused for distributing malicious software, disguised as popular films, games, and other content. Our previous research has shown that cybercriminals repeatedly turn to torrents as an initial infection vector, using trojanized cracks and installers to...

Malicious code in frank-apple-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2074ea7bc8e4cebf5e583f23cb534632931139d702252dfc554b75bfb5866072 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14967 Malicious code in 3layerdipstackvtd7og (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37994d3d03c7446f5f3251b1c84421b04e4cc0287ee51e7051a89fea429c79ad The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackfdgka0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6b1e8e507446d2e1921511d47721fa25899b90432339713bbaac218908d68b8 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackbn8wg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 35741d9482c4456cf11525450ddedbf61b937203e56bc4593d1d721b419d6d15 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Operation QUICSILVER Targets Myanmar Government and IT with QUICAgent Backdoor

Cybersecurity researchers have flagged a cyber espionage campaign targeting Myanmar that uses graduation ceremony invitation lures to deliver a Go backdoor called QUICAgent. The campaign, codenamed Operation QUICSILVER , has been found to target government and information technology sectors, per...

AI Is Learning to Write Genetic Code

This sort of research is both exciting and terrifying: The two models in question were told to generate complete genomes for a viable bacteriophage--a type of virus able to infect and replicate itself inside bacteria, destroying them from the inside. Using an existing bacteriophage as an...

MAL-2026-14313 Malicious code in node-runtime-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cac7a39a8896a7f78a20fe79758f146d2158f2fc529e51ac705720a745552770 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @sarex-team/ui-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 722e658713ad538fe6719d893d48c6bbea0c6cb84133e3a0010ef564ca6a1ec7 @sarex-team/ui-kit runs a DNS-based out-of-band exfiltration beacon on both npm install via package.json scripts.install = node index.js and on...

MAL-2026-14167 Malicious code in chalk-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57cc6705c0b1dabca055a6531e36802822a4441a367459efb4ba8ecbc4a92ce5 chalk-lib is a typosquat of the popular chalk package with an empty library body index.js exports whose entire effect is the postinstall lifecycle...