Remote command execution backdoor tool
rat/multi
Fallout in python, Aug 3 – Aug 9
What we caught this week while monitoring over 163,642,969 artifacts across 47 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.
SUNDAY
Sun Aug 9 · 16 catches · 1 wave · 3 singlesEmbedded credentials and admin remote execution
env/tokenremote-command/dispatch
Embedded private key, admin tool invocation
env/tokenremote-command/dispatch
Obfuscated credential, stealth browser automation
secrets/filtered-accessexploit/debug-interface
SATURDAY
Sat Aug 8 · 8 catches · 0 waves · 3 singlesComplex AI agent framework with persistence and evasion
delivery/download-executedropper/node-bootstrap
Embedded private key, admin tool invocation
env/tokenremote-command/dispatch
FRIDAY
Fri Aug 7 · 17 catches · 0 waves · 3 singlesExecutes base64 payload on install
install-hook/setupeval/scripting
AI pentesting platform with offensive tools
file-targeting/filtercracking/password
THURSDAY
Thu Aug 6 · 8 catches · 0 waves · 3 singlesimport-time exfiltration in init
recon-exfil/import-timeexploit/debug-interface
Batch script writes exe to AppData
WEDNESDAY
Wed Aug 5 · 13 catches · 0 waves · 3 singlesReverse shell and credential theft tool
reverse-shell/dupcredential-theft/registry
TUESDAY
Tue Aug 4 · 8 catches · 0 waves · 3 singlesRemote terminal agent with persistence
dispatch/evalrat/remote-agent
AI agent runtime executes arbitrary code
Discord token stealer with obfuscation
payload/code-in-databrowser/chromium
MONDAY
Mon Aug 3 · 14 catches · 0 waves · 3 singlesAutomation tool executes arbitrary code
Automated offensive pentest and exploit framework
webshell/requestexecution/persistence
O objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories