Fallout, Sep 14 – Sep 20

Thread hooking, PEB spoofing, self-deletion

Thread hooking, PEB spoofing, persistence

Shellcode injection and AV evasion

Shellcode injection and AMSI bypass

Typosquatting wallet key exfiltration

PowerShell Empire C2 framework

Obfuscated PowerShell execution

Uninstalls other extensions, steals cookies

Exfiltrates cookies, full browser control

bytenode, obfuscation, exfiltration, persistence

Automated payout theft bot

Installs MITM CA, intercepts traffic

Hardcoded exfil database credentials

Hardcoded exfil database credentials

Exfiltrates secrets via Telegram

Exfiltrates LinkedIn cookies to remote server

Contains actual malware samples

Embedded PHP webshell payload

Embedded PHP webshell payload

Clickfix malware loader

Clickfix malware loader

Remote code execution on open

Credential exfiltration and remote code execution

Exfiltrates env, executes remote code

installs MITM CA, intercepts AI traffic

Credential theft, account manipulation

Steals auth tokens, automates financial actions

Encoded PowerShell, C2, new package

Remote command execution, cookie theft

Phishing extension with credential capture

Remote command execution, cookie theft

Exfiltrates data to remote server

Offensive security framework with AI agent

C2 framework with RAT capabilities

C2 framework with RAT capabilities

Fake VPN extension farm

Mirai botnet malware source

Mirai botnet malware source

Credential harvesting and social media automation

CTF webshells and exploits included

Steals cookies, exfiltrates ticket data

Credential theft, obfuscation, C2, persistence

Steals wallet seed phrases

Offensive security framework with exploit tools

MITM root CA generation

Offensive security framework with agent skills

Exfiltrates cookies, credentials, and user data

preinstall hook, HTTP deps