InvisibilityCloak

InvisibilityCloak Proof-of-concept obfuscation toolkit for C post-exploitation tools. This will perform the below actions for a C visual studio project. Change the tool name Change the project GUID Obfuscate compatible strings in source code files based on obfuscation method entered by user Remov...

pe-sieve

Intro PE-sieve is a tool that helps to detect malware running on the system, as well as to collect the potentially malicious material for further analysis. Recognizes and dumps variety of implants within the scanned process: replaced/injected PEs, shellcodes, hooks, and other in-memory patches...

sbox

sbox - Compile-time AES string obfuscation for C++ Standard solutions rely on length + "" + string. That is trivial to reverse. sbox utilizes a constexpr AES-128 block cipher to mutate strings into high-entropy noise. The Story During the Neetcode "Encode and Decode Strings" challenge, I ported t...

dark-doh

dark-doh.exe public version Purpose: Download files via DoH, or download and execute a shellcode not implemented in the public version Run example: dark-doh.exe file1 download google yourdomain.com The supporting python script for DNS zone generation added py-prepzones.py. !!! Disclaimer !!! The...

Bin-Finder

Description This tool looks for either the processes that have a certain binary loaded or the processes that don't. This is useful in the following scenarios: It allows to detect processes where an specific EDR/AV dll is not loaded. This could lead to EDR's exception detection. It allows to obtai...

0xGUARD

📄 Features Module remapping Thread filtering Module hiding Memory check Integrity check Anti-DLL Injection Anti-Debugging Process policy Literal string obfuscation Compatibility with Themida/VMProtect ✔️ Dependencies Windows 711 Visual Studio 2019 🔧 How to use 1. Set options in options.h and build...

MAL-2026-16069 Malicious code in reactlogo-load (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0f9d76fcf9f229c0a11508004a2be764133c6195530c4d56563eb28c358ab5f The package presents itself as a logo/color utility but its exported loadLogo function extracts a URL from LSB-encoded bits of a PNG, fetches the...

MAL-2026-14273 Malicious code in rand-txs-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 383599a80e18acfe3bbf819e2c1cc5ec27a4663b2da9e18c7755000857196dc9 The package advertises itself as a random-transaction generator but its exported getTransactions API triggers execution of a hidden code payload...

CVE-2026-74886

opensslencrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks a different set of modules than the AST analyzer's DANGEROUSMODULES set. Attackers can bypass AST analysis through string obfuscation or encoding to import unblocked dangerous...

PYSEC-2026-3763

opensslencrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks a different set of modules than the AST analyzer's DANGEROUSMODULES set. Attackers can bypass AST analysis through string obfuscation or encoding to import unblocked dangerous...

CVE-2026-74886

opensslencrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks a different set of modules than the AST analyzer's DANGEROUSMODULES set. Attackers can bypass AST analysis through string obfuscation or encoding to import unblocked dangerous...

CVE-2026-74886 openssl_encrypt before 1.4.0 Plugin Import Guard Bypass

opensslencrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks a different set of modules than the AST analyzer's DANGEROUSMODULES set. Attackers can bypass AST analysis through string obfuscation or encoding to import unblocked dangerous...

CVE-2026-74886: Incomplete List of Disallowed Inputs

opensslencrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks a different set of modules than the AST analyzer's DANGEROUSMODULES set. Attackers can bypass AST analysis through string obfuscation or encoding to import unblocked dangerous...

PT-2026-76622

openssl encrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks a different set of modules than the AST analyzer's DANGEROUS MODULES set. Attackers can bypass AST analysis through string obfuscation or encoding to import unblocked dangerous...

Malicious code in pfa-errors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e06752c5f827cccdf98f23fa26d893d44e2889b8b7011e8fdb130524f09fe0f On require'pfa-errors', index.js unconditionally loads runtime.js, which fetches a platform-specific opaque binary from one of three hardcoded...

Android-Imgui-Template v0.1.0

Android ImGui Template Android menu template using Zygisk + ImGui. https://github.com/user-attachments/assets/816113d9-611d-4909-a08e-0f4e8ab6d03b Requirements Android NDK r27 ndk;27.0.12077973 Build Locally root@kitploit: export ANDROIDNDKHOME=/path/to/ndk/27.0.12077973 $ANDROIDNDKHOME/ndk-build...

MAL-2026-4408 Malicious code in @nolimit-x/win32-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 343787b335da015be56f49d118534c54bf81abab9e53b40bec0114d23bcc95c7 Package ships a single 8.1 MB Windows PE nolimit-core.exe as its main entry with only the description 'nolimit-x native binary for Windows x64' — no...

New ‘Plague’ PAM Backdoor Exposes Critical Linux Systems to Silent Credential Theft

Cybersecurity researchers have flagged a previously undocumented Linux backdoor dubbed Plague that has managed to evade detection for a year. "The implant is built as a malicious PAM Pluggable Authentication Module, enabling attackers to silently bypass system authentication and gain persistent S...

Researchers Detail Bitter APT’s Evolving Tactics as Its Geographic Scope Expands

The threat actor known as Bitter has been assessed to be a state-backed hacking group that's tasked with gathering intelligence that aligns with the interests of the Indian government. That's according to new findings jointly published by Proofpoint and Threatray in an exhaustive two-part analysi...

LodaRAT: Established Malware, New Victim Patterns

Executive Summary Rapid7 has observed an ongoing malware campaign involving a new version of LodaRAT. This version possesses the ability to steal cookies and passwords from Microsoft Edge and Brave. LodaRAT, first observed in 2016, is a remote access tool RAT written in AutoIt. Development of...