ModuleShifting

ModuleShifting Cet outil a été présenté lors de la conférence 2023 x33fcon : "Améliorer la furtivité des techniques d'injection mémoire" Vidéo Article de blog Qu'est-ce que c'est ModuleShifting est une variante plus furtive des techniques d'injection Module Stomping et Module Overloading. Elle es...

r77-rootkit

r77 Rootkit Fileless ring 3 rootkit r77 is a ring 3 rootkit that hides everything: Files, directories Processes & CPU/GPU usage Registry keys & values Services TCP & UDP connections Junctions, named pipes, scheduled tasks Hiding by prefix Everything that starts with "$77" is hidden. Configuration...

Next.js-RCE-Scanner-BurpSuite-Extension-

Extension Burp CVE-2025-55182 Next.js RCE Fonctionnalités Analyse passive : détection automatique de tous les sites Next.js passant par Burp Injection de code mémoire v2.2 Nouveau ! Faites un clic droit sur la requête cible, sélectionnez Injecter un code mémoire AntSword AntSword, prend en charge...

Insanity-Framework

Insanity-Framework CE PROJET EST MAINTENANT FERMÉ - N'HÉSITEZ PAS À LE CONTINUER Copyright 2017 Insanity Framework IF 2.0 FIN Écrit par: Alisson Moretto - 4w4k3 Remerciements spéciaux à Thomas Perkins - Ekultek Insanity Payload consiste à chiffrer votre code et à le déchiffrer en mémoire, évitant...

KittyStager

KittyStager KittyStager est un C2 de stage 0 comprenant une API, un client et un malware. L'API est responsable de la livraison de tâches de base et de shellcode à injecter en mémoire par le malware. Le client se connecte également à l'API et permet d'interagir avec le malware en créant des tâche...

memhunter

Memhunter Chasse automatisée des malwares résidents en mémoire à grande échelle Ce projet est EN COURS DE DÉVELOPPEMENT. Attendez-vous à des changements de fonctionnalités et des versions binaires dans les semaines à venir. Aperçu Memhunter est un outil capteur de points de terminaison spécialisé...

meterssh

Tool Name: MeterSSH Written by: David Kennedy Company: TrustedSec Website: https://www.trustedsec.com Twitter: @TrustedSec, @HackingDave MeterSSH is a way to take shellcode, inject it into memory then tunnel whatever port you want to over SSH to mask any type of communications as a normal SSH...

asminject

asminject.py asminject.py — это значительно модифицированный форк проекта dlinject Дэвида Бьюкенена. Внедряет произвольные ассемблерные или предварительно скомпилированные бинарные полезные нагрузки непосредственно в процессы Linux на архитектурах x86-64, x86 и ARM32, обращаясь к /proc//mem вмест...

ZoneClaw: Mitigating Persistent Memory Attacks by Establishing Memory-Zoning in OpenClaw-Style Computer-Use Agents

Computer-use agents increasingly operate as long-running assistants through persistent workspace memory, which OpenClaw-style CUAs realize as automatically reloaded files that hold user instructions, system summaries, and external claims at the same privilege level. Here, remembering a claim...

F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans

Malware linked to break-ins at F5 BIG-IP Access Policy Manager appliances hides a PHP web shell in memory instead of in a file on disk, Sophos said in an analysis published on September 7. When Apache loads any of the three appliances' own PHP scripts, the malware adds the web shell to the copy...

Suspected Chinese-Speaking Hackers Target Central Asian Governments With OctLurk and SilkLurk

A Chinese-speaking threat actor is suspected to be behind a fresh wave of cyber attacks targeting government organizations mainly located in Central Asia, including Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and the Syrian Arab Republic, since January 2025. These targeted...

New MemGhost Attack Plants Persistent False Memories in AI Agents Through One Email

Give an AI assistant a memory and access to your inbox, and you hand an attacker a way to rewrite what it thinks it knows about you. A single email can trick that agent into saving a false "fact" about the user, hide the change, and quietly steer its answers in later sessions. When it works, the...

CVE-2026-10223

A weakness has been identified in NousResearch hermes-agent up to 2026.4.30. This affects the function scanmemorycontent of the file tools/memorytool.py. This manipulation causes injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used f...

Persona Attack: Incremental Memory Injection Jailbreak Attack against Large Language Models

As Large Language Models evolve for user convenience, vulnerability to jailbreak attacks continues to be reported despite ongoing efforts in safety training. Traditional jailbreak techniques typically focus on a single prompt injection, neglecting the models' ability to remember the flow of...

FreeBSD -- Heap overflow in FUSE_LISTXATTR

Problem Description: When a fusefs file system implements extended attributes, the kernel may send a FUSELISTXATTR message to the userspace daemon to retrieve the list of extended attributes for a given file. The FUSE protocol requires the daemon to return a packed list of NUL-terminated strings...

CVE-2026-7647

The Profile Builder Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 3.14.5. This is due to the use of PHP's maybeunserialize function on the attacker-controlled 'args' POST parameter within the wppbrequestuserspinsactioncallback AJAX handler, whi...

DEAD#VAX Malware Campaign Deploys AsyncRAT via IPFS-Hosted VHD Phishing Files

Threat hunters have disclosed details of a new, stealthy malware campaign dubbed DEADVAX that employs a mix of "disciplined tradecraft and clever abuse of legitimate system features" to bypass traditional detection mechanisms and deploy a remote access trojan RAT known as AsyncRAT. "The attack...

Evasive Panda APT poisons DNS requests to deliver MgBot

Introduction The Evasive Panda APT group also known as Bronze Highland, Daggerfly, and StormBamboo has been active since 2012, targeting multiple industries with sophisticated, evolving tactics. Our latest research June 2025 reveals that the attackers conducted highly-targeted campaigns, which...

New ChatGPT Vulnerabilities Let Hackers Steal Data, Hijack Memory

Seven vulnerabilities in ChatGPT including GPT-5 allow attackers to use '0-click' and 'memory injection' to bypass safety features and persistently steal private user data and chat history. Tenable Research exposes the flaws...

New ChatGPT Atlas Browser Exploit Lets Attackers Plant Persistent Hidden Commands

Cybersecurity researchers have discovered a new vulnerability in OpenAI's ChatGPT Atlas web browser that could allow malicious actors to inject nefarious instructions into the artificial intelligence AI-powered assistant's memory and run arbitrary code. "This exploit can allow attackers to infect...