Fallout, this week

WMI hidden process, persistence, obfuscation

Obfuscated PowerShell download and execution

Obfuscated VBS executes decoded payload

Obfuscated WSH dropper runs PowerShell payload

Obfuscated dropper, C2, PowerShell exec

Obfuscated install hook exfiltrates data

Dependency contains credential stealer

MITM proxy intercepts AI traffic

Exfiltrates system data to canary

Empire C2 framework

Known offensive security toolkit

Clipboard exfiltration, obfuscated C2, wallet theft

Offensive security framework with evasion

Webshell deployment exploit toolkit

Webshell and WordPress exploit kit

CMS exploit toolkit

Process injection and code patching

Self-replicating batch trojan

Self-replicating batch virus

Self-replicating batch virus

Multi-arch dropper, C2, cleanup

Downloads and executes remote binaries

Downloads and executes remote exploits

Downloads and executes remote binaries

Malicious URL shortcut to IP

Credential theft, obfuscation, C2 tunnel

Crypto miner with persistence and C2

Downloads and executes remote malware

Downloads and executes remote malware

Downloads and executes remote payloads

Steals Telegram data, exfiltrates

Obfuscated VBS malware with registry access

obfuscated WhatsApp bot with remote code execution

Exfiltrates Depop auth tokens to ngrok

Ransomware and credential theft code

curl-pipe-sh, credential theft, persistence

Obfuscated credential stealer

Exfiltrates screen capture to Discord

Exfiltrates screen captures to Discord

Credential theft, obfuscation, weak passwords

preinstall reverse shell C2