CVE-2026-34621_PDF_SAMPLE

Technical Analysis of a Multi-Stage Adobe Acrobat PDF JavaScript Sample Overview This repository publishes a code-centric reverse-engineering write-up on a malicious PDF sample that embeds staged Adobe Acrobat JavaScript. The analyzed sample uses a hidden form field as its initial loader,...

DesckVB-RAT

DesckVB RAT v2.9 — Modular .NET RAT, Multi-Stage Delivery & Plugin Ecosystem Toolchain Linkage to “Pjoao1578” Author: ShadowOpCode X/Twitter: https://x.com/ShadowOpCode This repository accompanies a full technical report documenting an active malware ecosystem centered around DesckVB RAT , a...

Amaranth-Project

Amaranth Project Utilize CVE-2025-8088 WinRAR path traversal vulnerability, ≤ 7.11 to implement a multi-stage backdoor implantation attack chain. 诱饵文档 → 恶意RAR → CVE触发 → ADS写入 → Stager执行 → 文件加载 → C2上线 Project Structure Directory| Content ---|--- Stage01Stage07/| Source code and test scripts for...

cve-2025-55182-scanner

CVE-2025-55182 Indicator Scanner This repository provides a Python-based scanner for indicators of compromise related to CVE-2025-55182 React Server Components RCE and the specific multi-stage malware described in the Asleepace incident report. It is designed to run on Linux and macOS and focuses...

killchain

killchain “Kill Chain” es una consola unificada con un anonimizador que realizará estas etapas de ataques: Reconnaissance Weaponization Delivery Exploit Installation Command & Control And Actions Los conjuntos de herramientas dependientes son: 1. Tor -- Para el Anonimizador integrado en la consol...

RootQuest-CTF-Box-Multi-Stage-Exploitation-VM

RootQuest CTF Box — Multi-Stage Exploitation VM 💀 Kalaichelvan Thieveshkar CB013248 · Staffordshire University · COMP50003 - Cyber Security II Overview RootQuest is a purpose-built CTF virtual machine that contains a 10-stage , sequential attack path spanning 5 security domains. Each challenge...

Wazza Phishkit Targets Banking, Government, and Manufacturing Across the US, EU, and Australia

Phishing kits are no longer limited to copying a familiar login page and waiting for a victim to enter credentials. Attackers are increasingly building filtering, session management, and traffic controls into the infrastructure that delivers the phishing page itself. ANY.RUN has identified Wazza,...

The like Trap: Multi-Stage Poisoning against Agents in Similarity-Based Recommendation Systems

With recent advancements in large language models LLMs and LLM-based agents, these agents are becoming increasingly autonomous and gaining broader access to act on users' behalf on the internet. However, the vulnerability of automated agents deployed on social media platforms e.g., for managing a...

Tracking PavinLoader across ClickFix and fake download campaigns

In our previous analysis of the malicious RenPy campaigns, we identified a multi-stage loader deployed as part of the infection chain. Further threat hunting has since shown that the same loader, which we track as PavinLoader , is being used across several different campaigns, including ClickFix...

The invisible passenger in your car

While monitoring Android threats in June 2026, we discovered a new piece of Android malware. What struck us as unusual was that it installed like an ordinary user app yet made no attempt to disguise itself as legitimate software: it had no user interface at all. This led us to suspect the app mig...

Malicious code in json-validator-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 255dbc17164a6243a92bab0b4d71132efad3028b53e73d7d2924a1d7ccd1e8cf The package advertises itself as a JSON/XML validator but lib/core.js contains a multi-stage dropper triggered on any call to the public API...

128 Seconds to disruption: Microsoft Defender stops ransomware at QNET

In this article 1. What is device isolation? 2. Case study: QNET 3. Attack chain overview 4. MITRE ATT&CK techniques observed 5. References 6. Learn more Microsoft Defender's attack disruption now includes device isolation, a new response action that extends autonomous protection directly to...

ZIMPAF and RedPhuzz: High-Fidelity Web Application Fuzzing Via Branch, Language Construct, and Function Call Monitoring

We present ZIMPAF, runtime interpreter instrumentation, and RedPhuzz, a fuzzer, to address key limitations of state-of-the-art fuzzers: inefficient instrumentation, the lack of knowledge of the execution environment, and limited web domain knowledge. ZIMPAF implements a novel multi-granular runti...

DeepFaith: Evidence-Grounded LLMs for Faithful Incident Reporting in Multi-Stage APT Defense

Advanced Persistent Threats APTs are difficult to detect and interpret due to their multi-stage and stealthy nature. While recent autonomous defense systems leverage provenance graphs and learning-based models for detection and mitigation, their outputs remain largely machine-oriented and difficu...

An Automated Framework for Extracting Reachable Attack Chains from Cyber Threat Intelligence Reports

Cyber Threat Intelligence CTI reports richly describe real-world attack processes, but their unstructured narratives cannot be directly used for automated attack-path reasoning. Existing CTI extraction methods focus on indicators, entities, or TTP labels without modeling the execution conditions...

MAL-2026-10986 Malicious code in comp-colors (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ac2a6fc7368c6b3ed1bfac9a3a9ea25e9a54ba5d980a48767c811e03fc72566 The package presents itself as a local color-palette toolkit but exports a public colors function in remote.py that POSTs to the hardcoded endpoint...

Malicious code in colorstack (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05f3b08a41e5239924e109a14b8d91b4542bbbdddb1138a1bc6c9cfb7137b053 The package publishes as 'colorstack' with a summary advertising a color/gradient library, but installs under the import name 'newcolors' and exposes...

MAL-2026-10976 Malicious code in colorstack (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05f3b08a41e5239924e109a14b8d91b4542bbbdddb1138a1bc6c9cfb7137b053 The package publishes as 'colorstack' with a summary advertising a color/gradient library, but installs under the import name 'newcolors' and exposes...

Compromised AsyncAPI npm Packages Deliver Multi-Stage Botnet Malware

Four compromised npm packages in the @asyncapi namespace have been observed distributing a multi-stage botnet loader, according to findings from OX Security, SafeDep, Socket, and StepSecurity. The affected packages are listed below - @asyncapi/[email protected]...

MTD-Playground: An Attacker-Aware Evaluation Framework for Network Moving Target Defense

Moving Target Defense MTD has emerged as a proactive network cyber defense paradigm that increases attacker uncertainty through dynamic network reconfiguration techniques such as Software-Defined Networking SDN-enabled path randomization. However, existing evaluations remain fragmented due to...