OneNoteAnalyzer

OneNoteAnalyzer A C based tool for analyzing malicious OneNote documents Description Recently we came across few malicious OneNote Documents been distributed in-the-wild by various threat actors. This gave us an idea to develop "OneNoteAnalyzer" which would help in analysing such malicious OneNot...

depx

depx Malicious package & supply-chain intelligence Features • Installation • Usage • Running depx • JSON • Join Discord depx is a fast, passive supply-chain intelligence CLI. It tells you whether a package is known malicious hijacked publishes, credential stealers, install-script backdoors by...

CVE-2020-11579

CVE-2020-11579 Introduction PHPKB 9.0 Enterprise Edition MySQL database is affected by an unauthenticated arbitrary file disclosure via a malicious MySQL Server. A remote attacker can read any file on a remote victim host with web-server privileges e.g. www-data, via a single HTTP GET request. Re...

16 Malicious Firefox Extensions Pose as Rabby and OKX Wallets to Steal Recovery Phrases

Cybersecurity researchers have discovered a cluster of 16 malicious Mozilla Firefox extensions that are capable of stealing cryptocurrency wallet recovery phrases and private keys. "The extensions masquerade as wallet portals, desktop utilities, and browser tools, but their code intercepts recove...

LOLDrivers

LOLDrivers - Living Off The Land Drivers 🚗💨 Welcome to LOLDrivers Living Off The Land Drivers, an exciting open-source project that brings together vulnerable, malicious, and known malicious Windows drivers in one comprehensive repository. Our mission is to empower organizations of all sizes with...

DriverSentinel

🛡️ DriverSentinel 🛡️ Vulnerable Windows Driver Scanner DriverSentinel is a security tool developed in Go that detects malicious and vulnerable drivers on Windows systems by comparing them against the LOLDrivers.io database. Features • Installation • Usage • How It Works 📋 Table of Contents Features...

Malicious code in @dransay/address-validation (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 82ababa5637b2f53f5087a161eeba1b6ca6ddba6d31ebb7842614bf0da119fa7 The OpenSSF Package Analysis project identified '@dransay/address-validation' @ 99.0.0 npm as malicious. It is considered malicious because: - T...

U.S. Offers Up to $10 Million for Tips on Zhang Yu, Charged in HAFNIUM Hacks

The U.S. State Department is offering up to $10 million for information leading to the identification or location of Zhang Yu, a Chinese national charged in the United States in connection with the 2021 Microsoft Exchange Server attacks known as HAFNIUM. The reward is for information leading to h...

SkillSpector

SkillSpector Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, and security risks before installing agent skills. Overview AI agent skills used by Claude Code, Codex CLI, Gemini CLI, etc. execute with implicit trust and minimal vetting. In the 31,132-skill analyzed...

CVE-2021-40444

CVE-2021-40444 PoC Malicious docx generator to exploit CVE-2021-40444 Microsoft Office Word Remote Code Execution Creation of this Script is based on some reverse engineering over the sample used in-the-wild: 938545f7bbe40738908a95da8cdeabb2a11ce2ca36b0f6a74deda9378d380a52 docx file You need to...

np-audit

np-audit — npm package auditor Static security analysis for npm packages — detects obfuscated lifecycle scripts, known vulnerabilities, and malicious patterns before they run. Drop-in replacement for npm install and npm ci. Zero dependencies. Pure Node.js built-ins only. 100 kB on the wire. npx...

CVE-2025-8088-Winrar-Tool

CVE-2025-8088 WinRAR Exploit | || | \ / / | / | | | | Advanced WinRAR Path Traversal Exploit Tool A sophisticated GUI tool for creating malicious RAR archives that exploit the WinRAR path traversal vulnerability CVE-2025-8088 using ADS and RAR5 header manipulation. Features ADS Exploitation -...

CVE-2025-56383-Proof-of-Concept

Notepad++ v8.8.3 has a DLL hijacking vulnerability, which can replace the original DLL file to execute malicious code. The example method is as follows: Please note that the following demonstration uses npp.8.8.3.Installer.x64.exe to install Notepad++for testing, but in reality, any installed...

Demonstration-of-CVE-2023-38831-via-Reverse-Shell-Execution

CVE-2023-38831 Reverse Shell Demonstration This repository contains a PDF summary and screenshots of a lab-based demonstration of CVE-2023-38831. The vulnerability allows attackers to embed and execute malicious payloads in compressed files. In this case, the payload triggers a reverse shell...

Android-Disassembler

Android-Disassembler !ci12 CodeFactor Analyze malicious app on your phone Maintenance status Maintenance has resumed, but the project is still in a recovery and modernization phase. The baseline now expects initialized git submodules before building. Default open/import/export flows now use...

CVE-2023-23397-POC

CVE-2023-23397-POC Exploit POC for CVE-2023-23397 Appointment.cs : the modified file from https://github.com/Sicos1977/MsgKit/blob/master/MsgKit/Appointment.cs Exploit.cs : the code i used to replicate creating the malicious appointment . i modified the code picture in MDSEC article here :...

MAL-2026-17342 Malicious code in @bellaxchuu/belbails (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

CVE-2026-34621

CVE-2026-34621 : Adobe Acrobat 2026 Prototype Pollution & JS Injection Chain — Research PoC Overview This repository contains research material and proof-of-concept code developed during the analysis of the 2026 Adobe Acrobat Reader in-the-wild exploit chain involving: Prototype Pollution Interna...

jarm

JARM Please read the initial JARM blog post for more information. JARM is an active Transport Layer Security TLS server fingerprinting tool. JARM fingerprints can be used to: Quickly verify that all servers in a group have the same TLS configuration. Group disparate servers on the internet by...

MAL-2026-17396 Malicious code in kiyoramarkets (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...