isotope13 labs

Crit

Ecosystem

Domain

Confirmed

sc-only.bat Oct 7

742bfa9ed8a56e78fd8870f32d0ee02a98fd2ebb5417fd1ee7b0ae690dfa4a8f O(C)H(Os)

control/rdp

hidden-client.mrc Oct 7

dc93f3418c0bd7ee0f8077406ff7d57d5845d05b846f74b7753e43dc0ea6d71c O(C)H(Os)

95% mIRC malware with C2 and persistence

File manager.vb Oct 7

10dcc4eda26bfa52e2dbddb305a7c97f4e083e17d9ec1fef75c2234547cfac23 O(C)H(Os)

76% Unusual network file operations

Backdoor.Win32.Delf.akf Sep 26

9e10bcee30cbde0ecf4ca2e56da2f83806a7dbcd534bb7f6fbb41238c566f79c O(C)H(Os)

TXT Sonido.vb Sep 26

f2dfe0cb1cce31426c7459eaaec40f223db08a94d8b9d60c41731e0895b476f8 O(C)H(Os)

76% Unusual network text transmission

TXT Msgbox.vb Sep 26

8d71e3c81916d2ebc67a25ea4a159016c100b43aa1095f8c9664df62392ae9f8 O(C)H(Os)

76% Network exfiltration of user input

Form4.vb Sep 26

ed6fd312257714ac2c886bcb9b5f78e479d5765b0c48e9dc83f43fb8be336518 O(C)H(Os)

81% Remote file management C2

86c819592b938e0bd5badea164ddf8628c2348ce293828b33d1ef5a0d96d9d77 Sep 26

86c819592b938e0bd5badea164ddf8628c2348ce293828b33d1ef5a0d96d9d77 O(C)H(Os)

Backdoor.IRC.Kelebek.e Sep 24

fd5bb45979b143b2a59d4cc4bfe8401747f29258a0a5ee62a800bd14aeabcf5f O(C)H(Os)

95% IRC backdoor with persistence

Backdoor.IRC.Mox.ap Sep 23

4af12203c559da23ffa9118d749b82b6e0f9a046e68537ab4382c04dccdca953 O(C)H(Os)

83% IRC backdoor with C2 and persistence

cauldron_2d_drafter 0.1.4 Puts a Cauldron2D surface on screen as a drafter widget. 101 installs Sep 20 erlang

bde8fca151aea1580dd8f7eee9669971d8c212448f2148f7470c52d3f4f4f1fe O(C)H(Os)

cauldron_2d_drafter 0.1.3 Puts a Cauldron2D surface on screen as a drafter widget. 22 installs Sep 18 erlang

be9ace1728eceb42d7a0944e3f13230014e1e211a3c1501770d2fd755eadedc1 O(C)H(Os)

buf.build/gen/go/coscene-io/coscene-openapi/protocolbuffers/go v1.36.12-20260729110633-6566fd75c241.2 Sep 15 go

f059c8c38559d8fba470cad6d672aa0ddbe90084a7e74c00a89e71dcc41186b2 O(C)H(Os)

@roottale/cms-renderer-next 0.63.0 RootTale CMS public-render React/Next.js Server Components. SSR-only RSC components (RootTaleBlogList / RootTaleBlogPost / RootTaleLeadForm… Sep 12 javascript

c73a3e41a690f5da9b167a5240c0e93a62f046b3951bfb3e141fb3fbd4d48111 O(C)H(Os)

Backdoor.Win32.Frauder.eo Sep 12

9ab6f2c3cc3965cd05f81d859bdfac3b25a5e70178f61ea677d31987c4e142fd ✓ O(C)H(Os)

Email-Worm.VBS.Razor.a Sep 11

8781012a96176b4501649351125e2375eb079afd33ef52b1339c21ede0e0a76a O(C)H(Os)

IRC-Worm.VBS.Nirvach Sep 11

5b9256c1b0c375aa95f1fcc731e876ed5580f983b8ff606af1766a3dcf35ce89 O(C)H(Os)

pisper-runtime-node-0.5.39-darwin-aarch64/sidecar-runtime/runtime/chunks/chunk-6RPEGFK2.mjs Sep 10 javascript

0f42168b87c79759ec81fe251f21ae5199a1747bf62af53ade89e45adad9330e O(C)H(Os)

package/_448.js##unicode-escape@5933503 Sep 8 javascript

1229e87e1376c95de3c7eb971e078752dafdcc14c1eaa74b5500186f20488336 O(C)H(Os)

package/_448.js##unicode-escape@5939226 Sep 8 javascript

6cb50598f665097e213221d88af210808fa90b3dd0e87c985d483407bd91e3d4 O(C)H(Os)

package/_448.js##unicode-escape@5939893 Sep 8 javascript

7bb0cfbf3f8feb8435987cdd41a377d22f2a50369ef9deb81decafd0e96c4de0 O(C)H(Os)

package/_448.js##unicode-escape@5939228 Sep 8 javascript

11d5db4e24d07505ec735d38e7ca5716be3ae278e321c4f4ebc5dae5fda0e1a0 O(C)H(Os)

05a8c28d20329c1452fae3a5a925c9d4db7b0b74952322768b01f8679792f6be.bin Aug 23

05a8c28d20329c1452fae3a5a925c9d4db7b0b74952322768b01f8679792f6be ✓ O(C)H(Os)

delivery/hidden-stage

263201e489f91fc61e16ef07a05b8082555369715c555f48875ef67f321e5a0a.bin Aug 23

263201e489f91fc61e16ef07a05b8082555369715c555f48875ef67f321e5a0a ✓ O(C)H(Os)

96% HTA dropper with obfuscation

package/pipelines/lib/legacy/actions/update-pipeline-action.js Aug 23 go

6130741796b5a122830da0746078986aeab38c96bb83777e6225c6dd2b66a1ee O(C)H(Os)

github.com/rustdesk-org/clipboard-master v0.0.0-20251015134837-ddc39f00a621 Aug 3 go

c5348e50cb2ac669c20e1aca0b0ac1b3a6eae2d8987d993a2e80b866d930e025 O(C)H(Os)

github.com/retailnext/composevalidate v0.0.0-20260716070502-cd19ffec878d Jul 16 go

d46c5919384416b4bd72f8202708a02627e4c8c76855af25584bd864bbd78dd3 O(C)H(Os)

54% depends on suspicious golang: github.com/alecthomas/kong vv1.16.0

MDriven.WPFViewModelExternalControls.core 7.2.0.17427 Package Description 164,006 installs Jul 11 dotnet

a108271db1f2dbd2c9e2f6050f1de3ae7cd0777282b75862bb9481abfc336940 O(C)H(Os)

Social Character Counter cebfeficpmhdkcjmcgbhghjeohahhpah Count characters for Facebook, Twitter (X), and TikTok in a clean popup. Jul 8 chrome

3ba77faca137ccdbe507646d57bc4fd01e9eb2421c19201ed1b63f13061a3c20 O(C)H(Os)

36% Standard clipboard utility code

DevName Gen - Gợi Ý Tên Project 1.0.0 pfnjlihfbbbgpcjdcljcekfnjkhmlppa Tạo ngẫu nhiên tên dự án lập trình độc đáo với giao diện tự động thay đổi màu sắc liên tục. Jul 8 chrome

5d7b3761802485b01cee7d26295fb5135fec076eabc11cbeffc6ac25162a3c93 O(C)H(Os)

github.com/dagger/dagger/e2e/helm/dagger v0.0.0-20260707183335-94b97df8de1c Jul 7 go

92634036350381dee683e25f7ec7597e601ff9f981d4ccf9c78a4c847a9e32f0 O(C)H(Os)

100% Legitimate Go SDK source code

github.com/foomo/posh-providers/arbitrary v0.54.0 Jul 7 go

0d4a5303536b8ccb4a61d83db851bee96467b01013bebd02e997f309dc1204df O(C)H(Os)

42% Legitimate Go library source code

airbyte-source-azure-blob-storage 0.8.23 Source implementation for Azure Blob Storage. Jul 7 python

02dc85b9519833679d57403f8fdf8b97443a7266528ad2c7824d0e699a09acb6 O(C)H(Os)

55% Legitimate Airbyte connector source code

github.com/vmware-tanzu/vm-operator/external/infra v0.0.0-20260706214324-5a848b62c8d6 Jul 6 go

27dbb0adb28a28a4b695bbf70e4c4642d30c2819e017974f8bc680d70cc2d485 O(C)H(Os)

100% Legitimate Go module source code

fjomkkjamgdocahigpdkoiclhaignonk Jul 6 chrome

9215ad2fdefc0ce8974ac8ac9820a03493eaaba03d2717516c546a0335801fb9 O(C)H(Os)

55% Standard browser extension code

stateforward.hsm 1.3.1 Hierarchical State Machine implementation for Python with asyncio support Jul 6 python

f72e691eee4301c6b323d50d37c79537949b18299bf9e0c806853979ae521a29 O(C)H(Os)

80% Legitimate Python library source code

github.com/external-secrets/external-secrets/generators/v1/mfa v0.0.0-20260420085006-9be2c268b9f6 Jul 6 go

76d48b842bf3a96b541b879798ff78a914a28a1ef5dede743e0b83ffa7c8b44d O(C)H(Os)

100% Standard Go module definition

github.com/external-secrets/external-secrets/generators/v1/grafana v0.0.0-20260420085006-9be2c268b9f6 Jul 6 go

6e8f463d4b6ba9833ff2c6b95853e00159d7bb1e7a5ca6ff16ae565570871c43 O(C)H(Os)

100% Legitimate Go module source code

jnchaleapfhdpnhabhffeiffoepehplb Jul 5 chrome

a3023fb16aed3891e934ab7e289b7f0b0a27e4031eda7ab1e713bdb049f5a4bf O(C)H(Os)

kapkhpampgnmlodgaoccmoglcpdlblhf Jul 5 chrome

6087934d9e0047fc5be8eb71a6cf222c903ae60b54206dc4031f96b84c9a0881 O(C)H(Os)

nandidljkpdgfipbleniapmgkcdnifpo Jul 5 chrome

7a97c0ac8dc8c113207bac7890a3b7d106c6ee0791f66ca4e18fde1d0dd693d6 O(C)H(Os)

cjkogieodfhbjknfojllgdpnhjceilka 1.0 Jul 5 chrome

af5520cc556ff0a208c016e4b15502e619579d37387ece7aefbc6d9d536d093f O(C)H(Os)

85% Staged loader detected in archive

ijkgjajaiedkpclednpfhgdhmjgjcodi Jul 4 chrome

30b84c9374114dcabc01bb3de3c6364b9adb7b7a601ab59586937c11ae894e36 O(C)H(Os)

lmfoclikpghkghnkbipjkgoondhikali Jul 3 chrome

d1fda481aaff79261e02c2774f450583df32d9dc7bff6de32d267ed04364ee63 O(C)H(Os)

68% Legitimate password manager extension

bjpefdomjccdgkgdabflgijfmmkjehdh 1.0.0 Jul 3 chrome

727ff9062666f7b6208b1937d2aa7fc772f3378545026bc29e6768256ac436ce O(C)H(Os)

jpjnbplhpcodjnbffeafgndmgbfaphik 1.0.0 Jul 3 chrome

e57115bde5debd03eb979deeef750434d8c0c63b477fffb90099422b8c701199 O(C)H(Os)

nmagikmiahhfmgdfdkomejfglobmknpk Jul 2 chrome

4c29f444d5cf441db702bdeda5dca7cc45d5b3554a845d1450855c9df7f4f856 O(C)H(Os)

68% Standard browser extension UI code

gidpemphijniinhhlgnlbmfckhddcgld 1.0 Jul 1 chrome

1b13745cfea2bdc4113e82fccc058efa1a5cab7089e912fbcd1f04393b0dcb7d O(C)H(Os)

68% Clipboard copy is standard feature

occmlcgdopdjnkjihkodommogbkpkaob Jul 1 chrome

83df8456e7bad3b5fc469d26f0c86d726a125520a392f5397b6bab7d2e019d2c O(C)H(Os)

dravencms/locale 2.1.0 Locale module for dravencms 339 installs Jul 1 php

e4402233ed4485df5a56ff2b241dd779e6a6ce09123ccd8f8e447ef5d983f3bf O(C)H(Os)

66% Legitimate CMS locale module code

pinejadcmcdljlnlmpefogfebjlhanoi Jul 1 chrome

2d9bf92a2358ac608cb4d9439d405600028febada0bc26612d29616195c5a189 O(C)H(Os)

85% Staged loader archive detected

buf.build/gen/go/raystack/proton/protocolbuffers/go v1.32.0-20260629120123-e1d7f4aa427c.1 Jun 30 go

b717c39acdd52af217e677293ed51c0d72666deb78531e8cb75d0c0740ddce02 O(C)H(Os)

87% Legitimate Go protobuf generated code

vision-agents-plugins-fish 0.6.5 Fish Audio TTS and STT integration for Vision Agents Jun 30 python

bd5777e416d4e7123f821e09cdf7237fdb0081296c805f5c684f93f344fa971e O(C)H(Os)

44% Legitimate Python package plugin

mhhklgkihnhdagkmggdicbdgmkmbjkij Jun 30 chrome

adbca61b2c92359a66df28bb98a38c234f72099c12a5445f86f87a88bf6ba6a4 O(C)H(Os)

85% Staged loader archive detected

fnjdfnkfngfccccnnedbbaoepofknjmi Jun 29 chrome

62f3490a9b663087698672ac4deb3b568e3e5f97d32864aa9c661a5575240e97 O(C)H(Os)

85% Staged loader archive detected

datenkraft/bb-fulfillment-api-php-client v2.3.126 The Fulfillment API PHP Client enables you to work with the Fulfillment API 3,462 installs Jun 29 php

91a9cbc802775fe67b81cf29f8b6e1455153e198b5349fb750ccef7874256fd9 O(C)H(Os)

72% Legitimate PHP API client library

datenkraft/bb-fulfillment-api-php-client v2.4.8 The Fulfillment API PHP Client enables you to work with the Fulfillment API 3,462 installs Jun 29 php

3b7b07f745ae8d80f347e5b8d616f220d008c6d527d07b69ce472e1ddf82018d O(C)H(Os)

72% Legitimate PHP client library

ohhcobidgmnacldgkfpenfcbmemgpakk Jun 29 chrome

668abf6ce928875e3cd7559dba83c11d5e5fbee329a308976a1ae396bc8f8a44 O(C)H(Os)

85% Staged loader archive detected

eiaeamicejnpcioljkgeefiaegmknljj 1.0.0 Jun 29 chrome

a0f00f748a4c17c9cdb46979bb1ef12c646fd88682c14f5cfb45c4dadfab753e O(C)H(Os)

85% Staged loader archive detected

ooajfjobgddoofcomfnhjjmidljapggp Jun 28 chrome

990f11c3ae5e3940404773d6bf5310cf1993ddbf4d51b60307c7750889924af2 O(C)H(Os)

flyteplugins-dask 2.5.7b1 Dask plugin for flyte Jun 28 python

726ddddf8269816e40442694c29294185161e8ce52dfe7ba2e5904ac325ef2b7 O(C)H(Os)

bilnogkpbeococfgfddbfdbnkacobldo 1.0 Jun 28 chrome

438dbaa7843257746c1266eafe0d1decdd10a2d3416fc596db976b0b8d36a011 O(C)H(Os)

deepslate-core 0.1.13 Shared core library for Deepslate SDK integrations Jun 28 python

016738ed0d80846037ab6104810d2c3854b5d6f26980a73da8337685dd57cbc1 O(C)H(Os)

hfclpbefdeodolioldmobgnnilccenip 1.0 Jun 28 chrome

4111b67f43c12507b8a25460336621118d3e841fe77840b5034fffeb5189ee43 O(C)H(Os)

api.py Jun 28

767b91a199fb318cca1908f7caed568c8ec4e787d212093952c6431db5d9eeb4 O(C)H(Os)

jkffaaconekbadfebbmppempopjdjike 1.0.1 Jun 28 chrome

360c8a1aa57426c0b05dc028346c35e3bf7319a893fc77db836e09b40569d16c O(C)H(Os)

ippociaimipkinloiajnllcmebjnebnc Jun 27 chrome

4509a09fde885ab6b93fd5696c8028d507505bf3d2896c7558ad597a2381daab O(C)H(Os)

okagjcedohipoielmgiogfkdicbngkfn 1.0.0 Jun 27 chrome

42a212047e929abfa9efb1f4cf763a1487f07558507ad3eaaaf6274f6418b382 O(C)H(Os)

7f0511b09b1ab3a64c8827dd8af017acbf7d2688db31a5d98fea8a5029a89d56.unknown Jun 27

7f0511b09b1ab3a64c8827dd8af017acbf7d2688db31a5d98fea8a5029a89d56 O(C)H(Os)

100% WSH hidden execution and ActiveXObject

lgcffmgdjbpijjldfncgkbjgjcohiiim 1.0.0 Jun 27 chrome

4e0f09d4cea8b51e0760d5307bddc623a535a58f08cba19d89718c96827b5b45 O(C)H(Os)

ohpbbapcifagdfbjdedficbohbnkjiag 1.0 Jun 27 chrome

520c4eb76f41d58440fb6a6e48f334ae6bccee076e3f321094563acc3ceeb83e O(C)H(Os)

kopjflklmiodnghnkjplkcppcinigipc Jun 27 chrome

91c989203d478770bb9de421869c8b609b8ed63fc73de8a715c90520ea7529dd O(C)H(Os)

limdndkmclhcidkmomkhjdjhbfooehcf 1.0.0 Jun 27 chrome

159fe64ad382dedefa50c0e7af95b51b0a6db3fde35c2b24b45174916b78d44b O(C)H(Os)

nbbedafabhblbjhlfheobkmjbchpbgmc Jun 26 chrome

15cd22c36b7e7da8feef8342195e4ec6d098820542605e4d86d640bf6a6429a9 O(C)H(Os)

cpholmmlkkgnbehigiahgbgofgkjcieh Jun 26 chrome

a8fc6d45dc58bfc2db4b5ac0b967d9c661f27b20d1281d9f8161db544361ad90 O(C)H(Os)

pmkifojmhneblajafdofogafjfidcjag Jun 26 chrome

34280670b65d79a5d77748aa2953074ba5821c594c481b491ba0d5513d387cac O(C)H(Os)

pncdcnbgaifdcakpnkipbpelkhkahmil 1.0.1 Jun 26 chrome

14ad289f5fc10aa19bef6d924acd22ec5c1ff3fc0d254a620badfbf2732e6ed4 O(C)H(Os)

apjjnakgkdhgbmnblnhjnhdahclhlidj Jun 26 chrome

1a351c598ee70af49ad7ac5bd488e8c92e53bc147965c8659db6e0027e097933 O(C)H(Os)

github.com/external-secrets/external-secrets/providers/v1/passbolt v0.0.0-20260626102629-8cfe1a44b5bc Jun 26 go

db5f9d63873a2b089949810bf8c88b16522be70c0d62796c207ecd43b7f4559c O(C)H(Os)

bboeaobcnldjlkfoemmmbjbodgohgnpd 1.0.0 Jun 26 chrome

113d5b7beb91d8ff08f7558346ddfa83032e9b362d375c99ff746febc2420664 O(C)H(Os)

chgcgadicepjeijjnfjcebnghoplbdof 1.0.0 Jun 25 chrome

4fffb2b4e0317ffb30f83ded0f487f925b541b2e1190ad7fdebb1473bf7581d8 O(C)H(Os)

flyteplugins-dask 2.5.6 Jun 25 python

e6e525bc94e178737b865655f8afdf4fa2b1239d198edeec94677d08816357b8 O(C)H(Os)

bhpmndmklpkciodbdbphlilchlacoldp Jun 25 chrome

bb453c44594a4864e722040d1c377d87195d100db7664082dc4fbdbfdfe43b30 O(C)H(Os)

jfaajmhhdegmbpenalnngbfmgpbbokod Jun 24 chrome

fa1e7d9d1d131081a44f4e907c41017e17ccef3caf8f5cd17601c76baa478924 O(C)H(Os)

mpcihihcafeegcadflidhmhgmbplpkeo Jun 24 chrome

f29d42b18902f55f030a34dc6e4508d5caaa3eee044b8bce9d1fc0a15694e7f6 O(C)H(Os)

flyteplugins-dask 2.5.3 Jun 22 python

75aad014610203dc349b19833f6c0dfdea978558de870f8a4e7ddb41c8975568 O(C)H(Os)

videosdk-plugins-navana 1.0.22 Jun 22 python

3c02d9acbec497554659062eb1373a06f853dd2bb2bdc6cb2355e4adc053e2e8 O(C)H(Os)

videosdk-plugins-simli 1.0.22 Jun 22 python

c20abbff00c1a1161f9968ef9bf1f566ad6c7e8da27e6c4470729750db51b5ff O(C)H(Os)

haystack-vaultak 0.1.0 Jun 14 python

639d5131bd44bac78729affcfa727ecda1d093d9ee90787ad2b5c1b0639a770b O(C)H(Os)

yamltools4jedi 0.1.7 Jun 12 python

7c6e991cdcdc6ca2613c9efa321881faa409babf5f4936a7bc7a12bfd4c192b2 O(C)H(Os)

spotforecast2 8.1.0rc1 Jun 12 python

47002fc4055b0e244048c27fb0c42bde0eb0ff669d75405f55e3d4e1b0959e49 O(C)H(Os)

hxbit 0.1.0 Jun 11 python

9b9ab306a682b8db542983fdcfadf4e75c412d020a99ffe316f90ea39202418b O(C)H(Os)

spotforecast2 7.1.0 Jun 10 python

71e264d010b56b2fd28c6d17200a7a039d5567047e20d487290cd3c5d11a0804 O(C)H(Os)

sqlsentry 0.1.0 Jun 9 python

cef3b6269114641cb524567b3280101f79ee5abb9ef13cc7def8bbc24e8d263c O(C)H(Os)

BatchGotAdmin International-Fix Code.bat Jun 6

247d35a0c4544ccaf9b862f787b11a3961494d4901f0a6d911eb706adc507966 O(C)H(Os)

backup-laptop-HDD.bat Jun 6

92ec66f6963b505e6cc2a257897b80b992abd7e31cbfcc5244ef214f0687b5b6 O(C)H(Os)

github.com/cozystack/cozystack/api/apps/v1alpha1 v1.4.3 Jun 6 go

fcc44fea1d9aa8dda0ce297db0043341787b22a7633d24cbd0d4e4db78a8111a O(C)H(Os)

github.com/cozystack/cozystack/api/apps/v1alpha1 v1.3.6 Jun 6 go

45282f95fd5058d447feabcbbfcbb51a5ab88778d51b9c19e59729098f631b8f O(C)H(Os)

buf.build/gen/go/gotocompany/proton/protocolbuffers/go v1.34.2-20260605031625-c3a2e6bf59b3.2 Jun 5 go

4c88475431e8e7f7434c6236da3b01113149ad4506d691baf2717a1ba1ef75fd O(C)H(Os)

arch.py Jun 4

bcaad1b53f8076808c8d85d5bddc0644407a21b44dd8fbe9fc32deccc7f23d31 O(C)H(Os)

Index