Acacium-PostEx-Toolkit

Acacium Automated Post-Exploitation & Lateral Movement Toolkit...

CISA Warns of Two Malware Strains Exploiting Ivanti EPMM CVE-2025-4427 and CVE-2025-4428

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Thursday released details of two sets of malware that were discovered in an unnamed organization's network following the exploitation of security flaws in Ivanti Endpoint Manager Mobile EPMM. "Each set contains loaders for maliciou...

MAL-2025-47449 Malicious code in another-shai (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f3fba9cc731c68608bf4548a514b4491220c23775767b250f6c1cc318584a843 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Service SystemD Persistence

This module will create a service on the box, and mark it for auto-restart. We need enough access to write service files and potentially restart services Targets: CentOS 7 Debian = 7, = 15 Ubuntu = 15.04 Verified on Ubuntu 18.04.3 Module Options msf use exploit/linux/persistence/initsystemd msf...

Docker Image Persistence

This module maintains persistence on a host by creating a docker image which runs our payload, and has access to the host's file system /host in the container. Whenever the container restarts, the payload will run, or when the payload dies the executable will run again after a delay. This will...

Obsidian Plugin Persistence

This module searches for Obsidian vaults for a user, and uploads a malicious community plugin to the vault. The vaults must be opened with community plugins enabled NOT restricted mode, but the plugin will be enabled automatically. Tested against Obsidian 1.7.7 on Kali, Ubuntu 22.04, and Windows...

rc.local Persistence

This module will edit /etc/rc.local in order to persist a payload. The payload will be executed on the next reboot. Verified on Ubuntu 18.04.3 Module Options msf use exploit/linux/persistence/rclocal msf exploitrclocal show targets ...targets... msf exploitrclocal set TARGET msf exploitrclocal sh...

Init OpenRC Persistence

This module will create a service on the box via OpenRC, and mark it for auto-restart. We need enough access to write service files and potentially restart services. Verified against alpine 3.21.2 Module Options msf use exploit/linux/persistence/initopenrc msf exploitinitopenrc show targets...

Malicious code in kinyongi-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4ea7b4bf7dc393083c0cf1a329515fe98ac756a468ace3d791c4b0f20d2448e2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47368 Malicious code in zarabotok-na-obmenakh-bitkoinakh-d7rqlq46s (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 47355f63c693d1d5d45df79f7b39eb6971b2643d2413ddf90d090ed6ba38f67b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @openzeppelin-compact/fungible-token (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c6a498e2883ed809f6b7d0b0fdd09f303aaf958af5a94634d835e001fdc4db78 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47246 Malicious code in @morphodao/morpho-core-v1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cb9bd67a4d3649cd1f46a3e877bdffb2ed879805fe1aa9817036dd56b887f414 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in transform-remove-console (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 34def0802df34551bb9471a5204d7188e0b1d20db136c605b706bd98166df2d3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @pumpfun-sdk/bn-converter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 06bcd5e8715873a001eadde3f34011c22ba27a599e02a712fde9f44036b62fb0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sensay-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7cb7ee6c9001f05dabc23897e95ab73cf8e80b296c65d848d3d31fa9b2b592ec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47238 Malicious code in @fastifyv4/fastifyv4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7083057255001380bdd51cad61f09f708b1f711acee9a0f9c83f8ad4a6388201 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ts-jito (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cf71580a117fc1eb648238b8dbf5e2919978bc9bb694df76ef5b844542839736 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in working_tests (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49c21a63c0a80ed6817e5b19617e29f869d463d77843ef462ec7f9f177abe0aa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @rxnt/ambientiqstandaloneapi-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0d4084f155a192c466c14a5f1b90a954c7ce9be74b5071b04730d44510a364a2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

📄 Init OpenRC Persistence

This Metasploit module will create a service on the box via OpenRC, and mark it for auto-restart. We need enough access to write service files and potentially restart services. Verified against alpine 3.21.2. This module requires Metasploit: https://metasploit.com/download Current source:...