A PowerShell one-liner that unpacks a base64 and gzip encoded stage, which writes shellcode into RWX memory and runs it on a new thread. The shellcode connects to 185.243.115.227 over HTTPS and reads a further payload into executable memory.
A multi-stage macOS infostealer delivered as an AppleScript one-liner that installs a LaunchAgent for persistence and resolves its C2 domain via a public blockchain smart-contract call.
A PyInstaller-packed Python loader that patches AMSI and ETW, checks for sandboxes, then drops an obfuscated .NET dropper which deploys a Venom/AsyncRAT-lineage remote access trojan. The RAT persists through startup, registry and scheduled tasks, and supports keylogging, screen and webcam capture, credential theft, file encryption and USB spreading.
Type to search every report and article.