Coderrr: Open-Source AI Coding Agent
An open-source AI coding tool used by the operator to generate phishing delivery code, tests, and documentation.
Tag: product
Simba Service: Admin Delivery Panel
An admin tool left exposed on the server with default credentials, used to manage the phishing campaign.
Internet Explorer: Web Browser
Legacy browser whose diagnostics tool (iediagcmd.exe) was abused in the WebDAV hijack technique.
Audacity Audio Editor
Audacity, an open-source audio editor, was trojanized and distributed as a fake SSMS installer to deliver the OkoBot malware.
Volume2 Utility
Volume2 is an open-source utility that was used as a delivery mechanism for OkoBot payloads, carrying a malicious protobuf.dll.
1Password Password Manager
1Password is a password manager targeted by OkoSpyware for surveillance.
Tonkeeper Cryptocurrency Wallet
Tonkeeper is a cryptocurrency wallet targeted by OkoSpyware through browser title matching.
Trezor Suite Desktop Application
Trezor Suite is the official desktop application for managing Trezor hardware wallets. It was targeted by the SeedHunter module for phishing recovery…
Ledger Wallet Desktop Application
Ledger Wallet is a desktop application for Ledger hardware wallets. It was targeted by SeedHunter for injecting fake recovery pages.
SQL Server Management Studio (SSMS)
SQL Server Management Studio was used as a lure in a supply chain attack, where a fake installer actually delivered trojanized Audacity…