Data Exfiltration

cenobyte-vincit/slot2

UEFI GRUB2 bootkit that installs a pre-boot networked implant via NVRAM boot option, chainloads a UKI, executes a dracut payload, and kexecs the…

joelgmsec/fakedatagen

Generates fully valid fake identities in Spanish format, including names, emails, bank details, and extended info, with optional zip compression and…

kaandemir993/dropper-gcleaner-c2-infrastructure-kernel-driver-powershell-conhost-payload-analysis

Reverse engineering analysis of Dropper GCleaner, a malware that uses a resilient C2 infrastructure, kernel driver loading, PowerShell/Conhost…

tokyoneon/credphish

PowerShell script that invokes legitimate credential prompts and exfiltrates captured passwords over DNS using CredentialPicker and Resolve-DnsName.

flangvik/teamfiltration

Cross-platform framework for enumerating O365 accounts, password spraying, exfiltrating emails/Teams/OneDrive data, and backdooring EntraID accounts…

loociprian/gc2-sheet

GC2 is a Command and Control application that allows an attacker to execute commands on the target machine using Google Sheet or Microsoft SharePoint…

alessandroz/pupy

Pupy is an opensource, multi-platform (Windows, Linux, OSX, Android), multi function RAT (Remote Administration Tool) mainly written in python. It…

taurusomar/pulsegram

Python-based keylogger with Telegram bot integration for capturing keystrokes, clipboard content, and screenshots in authorized security testing…

tomiwa-ot/moukthar

Android remote administration tool

b3rito/peeko

peeko – Browser-based XSS C2 for stealthy internal network exploration via infected browser.

fsecurelabs/n1qlmap

The tool exfiltrates data from Couchbase database by exploiting N1QL injection vulnerabilities.

cleasbycode/jdvrif

Steganography Tool for JPG Images

malwaretech/exifsmugglingpoc

A Proof-of-Concept using Cache Smuggling + Exif data to passively download a second stage payload

androvirus/blacknet

Free advanced and modern Windows botnet with a nice and secure PHP panel developed using VB.NET.

zolderio/token-proxy

A transparent PII redaction proxy for LLM API traffic. Sits between an application and an LLM provider (currently Anthropic), pseudonymizing…

graysignal/cve-2024-23897-jenkins-arbitrary-read-file-vulnerability

Unauthenticated Jenkins CLI exploit scanner for CVE-2024-23897 that detects vulnerable versions and reads arbitrary files from the controller through…

defineid/skeletonkey

CVE-2026-6765 · Test only FormAutofill handlers exposed in Firefox