twittor

Twittor A stealthy Python based backdoor that uses Twitter Direct Messages as a command and control server This project has been inspired by Gcat which does the same but using a Gmail account. Setup For this to work you need: A Twitter account Use a dedicated account! Do not use your personal one...

Powershell-RAT

Powershell-RAT Python based backdoor that uses Gmail to exfiltrate data as an e-mail attachment. This RAT will help someone during red team engagements to backdoor any Windows machines. It tracks the user activity using screen capture and sends the information to an attacker as an e-mail...

Grok-backdoor

Grok-backdoor Grok-backdoor is a simple python based backdoor, it uses Ngrok tunnel for the C&C communication. Ngrok-backdoor can generate Windows, Linux and Mac binaries using Pyinstaller. How it works: Ngrok exposes local servers behind NATs and firewalls to the public internet over a secure...

NXcrypt

NXcrypt NXcrypt is a polymorphic 'python backdoors' crypter written in python by Hadi Mene h4d3s . The output is fully undetectable . NXcrypt can inject malicious python file into a normal file with multi-threading system . Run it with superuser's permissions . NXcrypt output is Fully undetectabl...

ReverseHttp

ReverseHttp HTTP POST/GET 요청을 통해 통신하는 Python 백도어 요구사항 Python 2.7 Cherrypy pip install cherrypy Requests pip install requests 사용법: 리스너 스크립트를 실행한 다음 컨트롤러를 실행하고 백도어 파일을 전송한 후 연결을 기다립니다. 스크린샷...

Wormy

Wormy - 도전 이 레포지토리에서 저는 자유 시간에 python3로 몇 가지 함수를 작성할 것입니다. 이 함수는 어떤 파이썬 백도어에도 "확산 기능웜처럼"을 추가합니다. 완성 후에는 실제 웜으로 만들 것입니다 할 일 목록 : 1드라이브에 확산, 시작 프로그램에 추가 및 지속적 확인✓ 2파이썬 스크립트에 주입하여 확산 ✓ 3ZIP 파일에 확산 ✓ 4공유 폴더에 확산 ✘ 5로컬 네트워크LAN에 확산 ✘ 6USB에 확산 ✘ 7P2P, 스카이프, 행아웃에 확산 시도 ✘ 8자신의 온라인 복사본을 만들고 확산에 사용 ✘ 9...아직 ...

gcat

Gcat Gmail을 명령 및 제어 서버로 사용하는 은밀한 Python 기반 백도어 이 프로젝트는 Benjamin Donnelly의 원본 PoC 코드에서 영감을 받았습니다. 이것은 PoC 코드입니다... ... 조직이 이러한 유형의 공격에 대한 방어를 테스트할 수 있도록 공개되었습니다. 이를 탐지하려면 RITA와 같은 프로젝트를 참조하세요. 이 프로젝트의 더 최신 유지 관리 버전은 GDog를 참조하세요. 설정 작동하려면 다음이 필요합니다: Gmail 계정 전용 계정을 사용하세요! 개인 계정을 사용하지 마세요! 계정의 보안 설정...

gcat

Gcat A stealthy Python based backdoor that uses Gmail as a command and control server This project was inspired by the original PoC code from Benjamin Donnelly This is PoC code... ... that was released for orginazations to test their defenses against these type of attacks. In order to detect them...

Malicious code in nrwl.angular-console (VSCode:https://open-vsx.org)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 12636eadc931d19fc68ca6d30f5397404c6b782a67537c770c944ed9337a4125 The compromised version of the Nx Console VS Code extension contains malicious code injected into its main execution file. When a develope...

MAL-2026-5161 Malicious code in nrwl.angular-console (VSCode)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 12636eadc931d19fc68ca6d30f5397404c6b782a67537c770c944ed9337a4125 The compromised version of the Nx Console VS Code extension contains malicious code injected into its main execution file. When a develope...

MAL-2026-5162 Malicious code in nrwl.angular-console (VSCode:https://open-vsx.org)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 12636eadc931d19fc68ca6d30f5397404c6b782a67537c770c944ed9337a4125 The compromised version of the Nx Console VS Code extension contains malicious code injected into its main execution file. When a develope...

Compromised Nx Console 18.95.0 Targeted VS Code Developers with Credential Stealer

Cybersecurity researchers have flagged a compromised version of the Nx Console extension that was published to the Microsoft Visual Studio Code VS Code Marketplace. The extension in question is rwl.angular-console version 18.95.0, a popular user interface and plugin for code editors like VS Code,...

Malicious code in trickery (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3ad5df28c8d5f5afa377d6b54a7eac1d3110610783c7e62fbd084a0bd49baac5 Package contains code to install a backdoor - and additionally to a user-controlled backdoor, it also installs the second, with own C2 server. It's not...

Silver Fox Deploys ABCDoor Malware via Tax-Themed Phishing in India and Russia

The China-based cybercrime group known as Silver Fox aka Monarch, SwimSnake, The Great Thief of Valley, UTG-Q-1000, and Void Arachne has been linked to a new campaign targeting organizations in Russia and India with a new malware called ABCDoor. The activity involved using phishing emails that...

New Python Backdoor Uses Tunneling Service to Steal Browser and Cloud Credentials

Cybersecurity researchers have disclosed details of a stealthy Python-based backdoor framework called DEEPDOOR that comes with capabilities to establish persistent access and harvest a wide range of sensitive information from compromised hosts. "The intrusion chain begins with execution of a batc...

Ransomware-Linked ViperTunnel Malware Hits UK and US Businesses

ViperTunnel is a Python-based backdoor linked to DragonForce ransomware that targets businesses using Windows servers across the US and the UK...

Iran-Linked MuddyWater Hackers Target U.S. Networks With New Dindoor Backdoor

New research from Broadcom's Symantec and Carbon Black Threat Hunter Team has discovered evidence of an Iranian hacking group embedding itself in several U.S. companies' networks, including banks, airports, non-profit, and the Israeli arm of a software company. The activity has been attributed to...

Cisco Patches Zero-Day RCE Exploited by China-Linked APT in Secure Email Gateways

Cisco on Thursday released security updates for a maximum-severity security flaw impacting Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager, nearly a month after the company disclosed that it had been exploited as a zero-day by a China-nexus advanced...

PLUGGYAPE Malware Uses Signal and WhatsApp to Target Ukrainian Defense Forces

The Computer Emergency Response Team of Ukraine CERT-UA has disclosed details of new cyber attacks targeting its defense forces with malware known as PLUGGYAPE between October and December 2025. The activity has been attributed with medium confidence to a Russian hacking group tracked as Void...

CVE-2022-43305

The d8s-python for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-algorithms package. The affected version of d8s-htm is 0.1.0...