172 matches found
PhEmail
PhEmail PhEmail은 사회 공학 테스트의 일환으로 피싱 이메일 전송 과정을 자동화하는 파이썬 오픈소스 피싱 이메일 도구입니다. PhEmail의 주요 목적은 웹 브라우저나 이메일 클라이언트를 악용하지 않고 최대한 많은 정보를 수집하면서 피싱 이메일을 대량으로 전송하고 누가 클릭했는지 입증하는 것입니다. PhEmail은 정보 수집 단계에서 유용하게 사용할 수 있는 LinkedIN을 통한 이메일 주소 수집 엔진을 제공합니다. 또한 이 도구는 Gmail 인증을 지원하며, 대상 도메인이 발신 이메일이나 IP 주소를 블랙리스트에...
cve-2023-23397-purple-team
CVE-2023-23397 — レッドチーム: 悪用 + 検知 同じOutlook NTLM漏洩脆弱性（CVE-2023-23397）に対する、1つのプロジェクトの2つの側面: レッドチーム（完了）: Windows 10被害者VMに対するCVE-2023-23397のフィッシング配信 +...
LetsDefend-SOC336-Windows-OLE-Zero-Click-RCE-Exploitation-Detected-CVE-2025-21298-
LetsDefend-SOC336-Windows-OLE-Zero-Click-RCE-Exploitation-Detected-CVE-2025-21298- 悪意のあるRTF添付ファイルを介して配信されたWindows OLEゼロクリックRCEエクスプロイト（CVE-2025-21298）を報告する重大なアラートを調査することが求められています。 LetsDefendからのアラートの調査 2025年2月4日16時18分、Austin @ letsdefend.io がメールを受信したことを受けてセキュリティアラートが発動しました。メッセージは projectmanagement ...
SOC336-Windows-OLE-Zero-Click-RCE-Exploitation-Detected-CVE-2025-21298
SOC336 - Windows OLE ゼロクリックRCE悪用の検出 CVE-2025-21298 ウォークスルー 🔎 目次 1. 状況 2. アラート概要 3. 使用ツール 4...
Mailphish
Mailphish 제작: Pro MCracker Mailphish는 전문적인 피싱 이메일을 빠르고 쉽게 생성할 수 있도록 도와줍니다. 해킹 방법을 배우려면 저희 웹사이트를 방문하세요 https://crackcodes.xyz 및 https://crackcodes.in 코드를 복사해서 자신의 것으로 만들 경우, 나에게 크레딧을 주는 걸 잊지 마세요, 꼬마야! 이 도구로는 크레딧을 얻을 수 없습니다 법적 고지 나는 당신이 이 도구를 교육 목적으로만 사용해야 하며, 다른 사람을 해킹하는 데 사용할 수 없다고 말하지 않겠습니다. 왜냐하...
CVE-2024-43451-POC
설명 이름 : CVE-2024-43451 CVSSv3 점수 : 6.5 영향받는 버전 : 2024년 11월 패치 이전의 모든 Microsoft Windows 버전 CVE-2024-43451은 Microsoft Windows의 제로데이 취약점으로, 사용자의 최소한의 상호작용만으로 NTLMv2 비밀번호 해시를 캡처할 수 있게 하여 잠재적으로 자격 증명 도난으로 이어집니다. 일반적으로 악용되는 방법은 원격 서버에 대한 SMB 연결을 통해 NTLM 인증을 활용하여 해시를 캡처하는 것입니다. 이 취약점은 2024년 11월 업데이트에서...
Project-NTLM-Hash-Capture-and-Phishing-Email-Exploitation-for-CVE-2024-21413
Project Goal: 이 프로젝트는 네트워크 상의 사용자로부터 NTLM 해시를 캡처하고 이메일을 사용한 피싱 공격을 실행하기 위한 다양한 도구의 사용을 시연하기 위해 만들어졌습니다. 이를 통해 네트워크 인증 취약점과 피싱 방법이 어떻게 시스템을 손상시키기 위해 악용될 수 있는지 보여줍니다. Process Description 1. Responder를 사용한 NTLM 해시 캡처 처음에는 Responder 도구를 사용하여 네트워크를 통해 인증 해시를 캡처했습니다. Responder는 LLMNR, NBT-NS, MDNS와 같은...
Exploit for Improper Input Validation in Microsoft
TryHackMe: Moniker Link — CVE-2024-21413 Walkthrough A full w...
Fake Microsoft Alerts Used to Deploy North Korean NarwhalRAT Malware
The North Korean state-sponsored hacking group known as ScarCruft aka APT37 has been observed using spear-phishing messages impersonating Microsoft Account security notifications to deliver a new malware called NarwhalRAT. "The attack email contained a message impersonating an MS account security...
CVE-2026-43876 WWBN AVideo: HTML Injection in notifySubscribers.json.php Enables Platform-Branded Phishing Emails to Channel Subscribers
WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/notifySubscribers.json.php takes the raw message POST parameter and passes it into sendSiteEmail, which substitutes it directly into an HTML email template via strreplace on the message placeholder and...
“Your shipment has arrived” email hides remote access software
An attachment in an email impersonating DHL about a shipment contains a link to a preconfigured SimpleHelp remote access tool—an ideal starting point for attackers to explore a network, steal data, and drop additional malware. A German industrial spare parts and equipment supplier received an ema...
PT-2026-28215
Hi guys! Recently I got this email from [email protected]. I read through the email and spotted a few grammatical errors, as well as a share.google link, which I thought was unusual for Microsoft to do. Even though it was fully delivered and signed by GitHub.com, I realised that what the...
Before You Hand over the Wheel: Evaluating LLMs for Security Incident Analysis
Security incident analysis SIA poses a major challenge for security operations centers, which must manage overwhelming alert volumes, large and diverse data sources, complex toolchains, and limited analyst expertise. These difficulties intensify because incidents evolve dynamically and require...
How fake party invitations are being used to install remote access tools
“You’re invited!” It sounds friendly, familiar and quite harmless. But in a scam we recently spotted, that simple phrase is being used to trick victims into installing a full remote access tool on their Windows computers—giving attackers complete control of the system. What appears to be a casual...
Be careful responding to unexpected job interviews
One of our customers was contacted on LinkedIn about a job offer. The initial message was followed up by an email: “Thank you for your interest in the Senior Construction Manager position at company. After reviewing your background, we were impressed with your experience and would like to invite...
We opened a fake invoice and fell down a retro XWorm-shaped wormhole
Somebody forwarded an “invoice” email and asked me to check the attachment because it looked suspicious. Good instinct—it was, and what we found inside was a surprisingly old trick hiding a modern threat. What it does If the recipient had opened the attached Visual Basic Script .vbs file, it woul...
Phishing emails disguised as spam filter alerts are stealing logins
Cybercriminals are spoofing "email delivery" notifications to look like they came from spam filters inside your own organization. The goal is to lure you to a phishing site that steals login credentials—credentials that could unlock your email, cloud storage or other personal accounts. The email...
How credentials get stolen in seconds, even with a script-kiddie-level phish
This attempt to phish credentials caught our attention, mostly because of its front-end simplicity. Even though this is a script-kiddie-level type of attack, we figured it was worth writing up—precisely because it’s so easy to follow what they're up to. The email is direct and to the point. Not a...
