Attackers are distributing a data-stealing trojan named ChocoPoC through fake proof-of-concept (PoC) exploit repositories on GitHub, specifically targeting vulnerability researchers. The malware,…
ChocoPoC is a remote access trojan that hides in Python dependencies of fake PoC exploit repositories on GitHub. It steals credentials, cookies,…
WebRAT is a trojan that was pushed via fake CVE PoCs in late 2025, primarily targeting students and junior testers, as mentioned…
TinyRCT is a previously undocumented .NET backdoor discovered by Palo Alto Networks Unit 42. It is a lightweight remote access trojan capable…
A remote access trojan delivered as a second-stage payload in the PolinRider campaign. Unpacked from encrypted payloads fetched via blockchain services like…
Cabbage RAT, also known as CageyChameleon, is a PowerShell-based remote access trojan used by North Korean threat actors for credential and data…
NarwhalRAT is a Python-based remote access trojan (RAT) used by the North Korean group ScarCruft. It is capable of keylogging, screen capture,…
BabaDeda Loader is a malware loader first documented by Morphisec in November 2021. It uses ClickFix social engineering to deliver payloads like…
EtherRAT is a remote access trojan (RAT) delivered via the Potemkin loader in ClickFix campaigns. It is used alongside RMMProject for credential…
SectopRAT, also known as ArechClient, is a remote access trojan delivered via BabaDeda Loader. It is deployed using DLL side-loading and provides…