r77-rootkit

r77 Rootkit Fileless ring 3 rootkit r77 is a ring 3 rootkit that hides everything: Files, directories Processes & CPU/GPU usage Registry keys & values Services TCP & UDP connections Junctions, named pipes, scheduled tasks Hiding by prefix Everything that starts with "$77" is hidden. Configuration...

Next.js-RCE-Scanner-BurpSuite-Extension-

CVE-2025-55182 Next.js RCE Burp Extension Plugin Features Passive Scanning : Automatically detect all Next.js sites passing through Burp Memory Shell Injection v2.2 New! Right-click on the target request, select Inject AntSword Memory Shell AntSword, supports both GET and POST types of memory...

Insanity-Framework

Insanity-Framework THIS PROJECT ARE CLOSED NOW - FEEL FREE TO CONTINUE IT Copyright 2017 Insanity Framework IF 2.0 END Written by: Alisson Moretto - 4w4k3 Special Thanks to Thomas Perkins - Ekultek Insanity Payload consists of encrypting your code and decrypting it in memory, thus avoiding a...

ModuleShifting

ModuleShifting This tool has been presented at the 2023 x33fcon talk: "Improving the stealthiness of Memory Injection Techniques" Video Blogpost What is it ModuleShifting is stealthier variation of Module Stomping and Module overloading injection technique. It is actually implemented in Python...

meterssh

Tool Name: MeterSSH Written by: David Kennedy Company: TrustedSec Website: https://www.trustedsec.com Twitter: @TrustedSec, @HackingDave MeterSSH is a way to take shellcode, inject it into memory then tunnel whatever port you want to over SSH to mask any type of communications as a normal SSH...

KittyStager

KittyStager KittyStager is a stage 0 C2 comprising an API, client, and malware. The API is responsible for delivering basic tasks and shellcode to be injected into memory by the malware. The client also connects to the API and allows for interaction with the malware by creating tasks. The goal of...

memhunter

Memhunter Автоматическая охота на вредоносное ПО, находящееся в памяти, в масштабе Этот проект находится в стадии разработки. В ближайшие недели ожидаются изменения функционала и бинарные релизы. Обзор Memhunter — это инструмент-сенсор конечных точек, специализирующийся на обнаружении резидентног...

asminject

asminject.py asminject.py는 David Buchanan의 dlinject 프로젝트를 대폭 수정한 포크입니다. ptrace로 프로세스에 붙는 대신 /proc//mem에 접근하여 임의의 어셈블리또는 사전 컴파일된 바이너리 페이로드를 x86-64, x86, ARM32 Linux 프로세스에 직접 주입합니다. 신뢰된 프로세스 변조, 특정 사후 악용post-exploitation 시나리오, 프로세스 메모리에서 콘텐츠 복구, 일부 보안 통제 우회에 유용합니다. 컨테이너 외부에서도 호스트에서 root 접근 권한만 있다면...

Suspected Chinese-Speaking Hackers Target Central Asian Governments With OctLurk and SilkLurk

A Chinese-speaking threat actor is suspected to be behind a fresh wave of cyber attacks targeting government organizations mainly located in Central Asia, including Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and the Syrian Arab Republic, since January 2025. These targeted...

New MemGhost Attack Plants Persistent False Memories in AI Agents Through One Email

Give an AI assistant a memory and access to your inbox, and you hand an attacker a way to rewrite what it thinks it knows about you. A single email can trick that agent into saving a false "fact" about the user, hide the change, and quietly steer its answers in later sessions. When it works, the...

CVE-2026-10223

A weakness has been identified in NousResearch hermes-agent up to 2026.4.30. This affects the function scanmemorycontent of the file tools/memorytool.py. This manipulation causes injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used f...

Persona Attack: Incremental Memory Injection Jailbreak Attack against Large Language Models

As Large Language Models evolve for user convenience, vulnerability to jailbreak attacks continues to be reported despite ongoing efforts in safety training. Traditional jailbreak techniques typically focus on a single prompt injection, neglecting the models' ability to remember the flow of...

FreeBSD -- Heap overflow in FUSE_LISTXATTR

Problem Description: When a fusefs file system implements extended attributes, the kernel may send a FUSELISTXATTR message to the userspace daemon to retrieve the list of extended attributes for a given file. The FUSE protocol requires the daemon to return a packed list of NUL-terminated strings...

CVE-2026-7647

The Profile Builder Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 3.14.5. This is due to the use of PHP's maybeunserialize function on the attacker-controlled 'args' POST parameter within the wppbrequestuserspinsactioncallback AJAX handler, whi...

DEAD#VAX Malware Campaign Deploys AsyncRAT via IPFS-Hosted VHD Phishing Files

Threat hunters have disclosed details of a new, stealthy malware campaign dubbed DEADVAX that employs a mix of "disciplined tradecraft and clever abuse of legitimate system features" to bypass traditional detection mechanisms and deploy a remote access trojan RAT known as AsyncRAT. "The attack...

Evasive Panda APT poisons DNS requests to deliver MgBot

Introduction The Evasive Panda APT group also known as Bronze Highland, Daggerfly, and StormBamboo has been active since 2012, targeting multiple industries with sophisticated, evolving tactics. Our latest research June 2025 reveals that the attackers conducted highly-targeted campaigns, which...

New ChatGPT Vulnerabilities Let Hackers Steal Data, Hijack Memory

Seven vulnerabilities in ChatGPT including GPT-5 allow attackers to use '0-click' and 'memory injection' to bypass safety features and persistently steal private user data and chat history. Tenable Research exposes the flaws...

New ChatGPT Atlas Browser Exploit Lets Attackers Plant Persistent Hidden Commands

Cybersecurity researchers have discovered a new vulnerability in OpenAI's ChatGPT Atlas web browser that could allow malicious actors to inject nefarious instructions into the artificial intelligence AI-powered assistant's memory and run arbitrary code. "This exploit can allow attackers to infect...

Chinese APT Deploys EggStreme Fileless Malware to Breach Philippine Military Systems

An advanced persistent threat APT group from China has been attributed to the compromise of a Philippines-based military company using a previously undocumented fileless malware framework called EggStreme. "This multi-stage toolset achieves persistent, low-profile espionage by injecting malicious...

PT-2025-34757 · Macvim · Macvim

Name of the Vulnerable Software and Affected Versions: MacVim affected versions not specified Description: MacVim’s configuration on macOS, specifically the presence of the “com.apple.security.get-task-allow” entitlement, allows local attackers with unprivileged access to attach a debugger, read ...