A multi-stage macOS infostealer delivered as an AppleScript one-liner that installs a LaunchAgent for persistence and resolves its C2 domain via a public blockchain smart-contract call.
A PyInstaller-packed Python loader that patches AMSI and ETW, checks for sandboxes, then drops an obfuscated .NET dropper which deploys a Venom/AsyncRAT-lineage remote access trojan. The RAT persists through startup, registry and scheduled tasks, and supports keylogging, screen and webcam capture, credential theft, file encryption and USB spreading.
Type to search every report and article.