A multi-stage macOS infostealer delivered as an AppleScript one-liner that installs a LaunchAgent for persistence and resolves its C2 domain via a public blockchain smart-contract call.
A PyInstaller-packed Python loader that patches AMSI and ETW, checks for sandboxes, then drops an obfuscated .NET dropper which deploys a Venom/AsyncRAT-lineage remote access trojan. The RAT persists through startup, registry and scheduled tasks, and supports keylogging, screen and webcam capture, credential theft, file encryption and USB spreading.
A 32-bit C# VenomRAT-style Trojan persists in AppData and decrypts an AES-256 config (RSA-signed) before connecting to a certificate-pinned C2 over TLS. It logs keystrokes, enumerates system info, downloads plugins, and continuously runs anti-analysis checks plus a process-killer to evade inspection.
Type to search every report and article.