MacSync Stealer: A macOS Information Stealer
MacSync Stealer is a macOS-focused information stealer that collects credentials, cookies, SSH keys, AWS credentials, and other sensitive data. It uses ClickFix…
Category: Malware
Malware families, payloads, loaders, ransomware and related tooling.
Microsoft Ties 30+ Rotating Domains to MacSync Stealer Infrastructure
Microsoft Defender Experts have linked more than 30 web domains to MacSync Stealer, a macOS-focused information stealer, by correlating endpoint and network…
Remotely: RMM Tool Used by Ransom Busters
Remotely is a remote monitoring and management (RMM) tool installed via PowerShell script by the Ransom Busters threat actor for remote access.
SoftPerfect Network Scanner: Reconnaissance Tool
SoftPerfect Network Scanner is a network scanning tool used by Ransom Busters for internal reconnaissance during intrusions.
s5cmd: Data Exfiltration Tool
s5cmd is a command-line tool for interacting with cloud storage, used by Ransom Busters to exfiltrate data to cloud storage.
TWINLOOT Malware Abuses SharePoint and Teams to Steal Credentials and Pivot Networks
Cybersecurity researchers have uncovered a new Python-based implant framework called TWINLOOT that abuses trusted Microsoft services for command-and-control (C2) operations. The malware,…
TWINLOOT: Python Implant Abusing Microsoft Services for C2
TWINLOOT is a modular Python implant hardened with PyArmor that uses SharePoint Online and Microsoft Teams TURN relays for command-and-control. It steals…
msaRAT: Rust-Based RAT Using TURN Relays and Headless Browsers
msaRAT is a Rust-based remote access trojan attributed to the Chaos ransomware group. It uses a headless browser and WebRTC DataChannels via…
Mind Virus: Self-Propagating AI Payloads
Mind viruses are self-propagating payloads that spread between AI agents via persistent prompt files like SOUL.md. Developed by Anthropic and EPFL researchers,…
AgentWorm: AI Worm Targeting OpenClaw
AgentWorm is a self-replicating worm targeting OpenClaw, reported with a 63% aggregate attack success rate across five model backends. Originally named ClawWorm,…