Fallout, Aug 17 – Aug 23

obfuscated crypto drainer in config

Stealth browser automation for evasion

Webshell, backdoor, C2, persistence

FreePBX webshell and backdoor

Multi-arch botnet dropper

Multi-stage FreePBX webshell dropper

AD post-exploitation shell

AD post-exploitation shell

Tor-based remote payload deployment

AD post-exploitation shell

Game cheat with process injection

malicious dependency htmlescape

obfuscated remote-controlled agent backdoor

obfuscated remote-controlled agent backdoor

SQL injection exploitation tool

Themida-packed, unsigned, future-dated, admin-required

Exfiltrates LinkedIn session cookies to remote server

Ransomware encryption indicators present

Embedded PHP webshell in test data

Process injection and privilege escalation

obfuscated eval backdoor in installer

Font file hides crypto-stealer payload

Obfuscated crypto-stealer in font file

Malicious Node payload in font file

Obfuscated Lua payload, masquerading executables

Malicious VS Code task payload

Malicious VS Code tasks and obfuscated payload

Malicious code disguised as font file

WinDivert kernel driver dependency

Browser cookie theft

Exfiltrates WhatsApp session keys

Bundled SweetAlert2 protestware payload

Malicious dropper script

Obfuscated VBS dropper with C2

Multi-stage webshell with root persistence

Dropper downloads and executes raw-IP payloads

.NET RAT with screen capture

obfuscated, hostname-gated hidden VBS loader

XOR-decoded VBS payload execution

Obfuscated WMI execution and shell access

Obfuscated WMI execution, file copy

obfuscated hidden WMI loader

Obfuscated WSH malware with persistence

Malicious region-gated audio payload

Embedded keylogger in Mendix module

Botnet dropper with C2 and persistence

Malicious dropper script

Extensive spyware and injection APIs

AD post-exploitation shell

Obfuscated C2 payload in font file