atomdrift lab - Fallout

windows-bindgen 0.65.0 biggest blast radius kernel-hide.rootkitdegrade.calculation 5,639,623 installs crates 1 hour ago

dotnet-bootstrap-8 8.0.129-r23 masquerade.binaryreflection.invoke wolfi 2 hours ago

25616:thebrain reflection.invokestaging.memory macos 9 hours ago

io.github.davidtimur:c2-lab 1.0.0 http.uploadtasking.http ✓ java 8 hours ago

C2 beacon exfiltrating host reconnaissance data

ihldefkgpnceoelikkacpffhabnhfdpm chrome 12 hours ago

Impersonates Proton VPN with fake servers

iiklplackpgeahbbnhbcogdchlbdgjco http.report chrome 13 hours ago

pkg:gem/[email protected] execution.string-reconstructindicator-removal.timestamps go 2 hours ago

pkg:golang/go.dedis.ch/kyber/[email protected] trojanized.build-pipeline go 7 hours ago

BG58FINV915010BGNBRKTF_20260728.PDF steganography.imagestaging.memory windows 7 hours ago

IObit.DriverBooster brand.productstaging.embedded windows 11 hours ago

IObit Driver Booster contains spyware components

VovSoft.FilenameLister keylog.capture windows 12 hours ago

Embedded spyware with keylogger and exfiltration

SC-816720-PDF1.js script.wshscript.dropper javascript 7 hours ago

Obfuscated PowerShell dropper downloading malicious payload

@ruffle-rs/ruffle 0.5.0 javascript 13 hours ago

Demande d'achat_.bat staging.encrypted 7 hours ago

MSI_PRO.png delivery.stego 14 hours ago

mips rival-bot.competitorshell.tasking linux 7 hours ago

Satori botnet malware binary

titanjr.arm5 init.bootbotnet.iot linux 7 hours ago

IoT botnet malware with persistence

x86 malformed.elf-headerDirtyfragshellcode.May26 linux 7 hours ago

Contains exploits, persistence, and C2 strings

bingo-ai 7.2.1 reverse-shell.ptyllm.override ✓ python 8 hours ago

AI-powered red teaming and exploitation toolkit

bingo-ai 7.2.2 reverse-shell.dupllm.override ✓ python 9 hours ago

AI-powered red teaming and exploitation framework

Purchase Order PO K 0158.js ✓ javascript 7 hours ago

Obfuscated code with dynamic function construction

🌊 extension-fix-9X2OY8.hta and 10 siblings activex.comhidden.execution 1 day ago

Obfuscated HTA downloader using ActiveX

🌊 extension-fix-RLDATX.hta and 8 siblings activex.comhidden.execution 1 day ago

Obfuscated HTA downloader using ActiveX

gitlab-labkit 4.0.0 first seen anywhere credential-theft.registry 51,416,192 installs ruby 1 day ago

GemBox.Pdf 2026.8.101 staging.memoryreflection.invoke 4,646,704 installs dotnet 18 hours ago

Unsigned DLL with reflection-based resource loader

windows 0.46.0 biggest blast radius keylog.hookfirewall.wfp 283,825,870 installs crates 1 day ago

ntapi 0.4.1 anti-av.syscall 101,191,106 installs crates 1 day ago

curl-sys 0.4.38+curl-7.73.0 obfuscation.wshscripting.host 45,653,350 installs crates 1 day ago

github.com/eclipse/paho.golang v0.10.0 trigger.activation golang 1 day ago

can1357/oh-my-pi v17.2.2 reverse-shell.duprecon-exfil.install-hook github 1 day ago

VA Autofill 0.9.3 va-autofill 6 installs firefox 20 hours ago

Extension contacts external auth server

Facilita 1.2.313 facilita http.reportexfiltration.sensitive-data 5 installs firefox 1 day ago

Extension exfiltrates credentials and browsing data

MyShield 1.0.0 myshield crypto-manipulation.clipboard 1 installs firefox 20 hours ago

Clipboard hijacking with hardcoded crypto address

pkg:github/retrovibed/retrovibed trigger.activationdebugger-detect.combined-checks arch 17 hours ago

arctis-sound-manager 1.2.13 init.bootinstall-hook.distro-scriptlet arch 1 day ago

v1.9.21.tar.gz binary-metrics.shapedebugger-detect.check arch 1 day ago

kfpjopggikbnmjpgcmeokabmpdnkdajb messaging.whatsapphttp.report chrome 17 hours ago

Exfiltrates WhatsApp session credentials

ljgghpflkpcigblfoaiclhhebjgpiamj chrome 19 hours ago

Steals Etsy cookies and CSRF tokens

ahlpigmipbpdeljbnamlkelakjbneijp chrome 21 hours ago

Automated credential stuffing and login bypass

koru 0.1.445 python 1 day ago

Automation tool executes arbitrary code

agent-forge-installer 0.4.41 automation.agentcron.job python 1 day ago

Sandbox bypass flags in agent runner

atlispcc 0.1.8 obfuscation.decoderspack.runtime python 1 day ago

github.com/codyswanngt/lisa v2.323.2-0.20260804004420-2e5f04f9499c+incompatible install-hook.remote-binaryvalidation.check go 18 hours ago

npm postinstall fetches remote native executable

github.com/adbc-drivers/driverbase-go/testutil v0.0.0-20260803160758-8f4d5c91c894 credential-theft.env go 1 day ago

github.com/kdlbs/kandev v0.84.2-0.20260803141219-cc6eb4dd5f62 trojanized.build-pipeline go 1 day ago

Notion.Notion package.direct-urlrat.config windows 16 hours ago

ExacqTechnologies.exacqVisionClient staging.embedded windows 19 hours ago

Hostile embedded resource loader detected

InspectDevTools.Inspect dispatch.modulestaging.embedded windows 22 hours ago

@bobfrankston/mailx-store-web 0.1.69 http.report javascript 17 hours ago

@oh-my-pi/pi-coding-agent 17.2.5 staging.archiveexecution.wsh javascript 1 day ago

@cline/core 0.0.69 phishing.device-code javascript 1 day ago

lJqsG delivery.stegoinfrastructure.ip-port 16 hours ago

textgen reverse-shell.pty 19 hours ago

Embedded PTY backdoor in Python binary

846bb7ba9ca2… payload.self-readpayload.encoded 20 hours ago

Malicious DLLs with anti-debug loaders

arm7 mirai.corebotnet.iot linux 18 hours ago

lkxstress.sh4 mirai.corebotnet.iot linux 18 hours ago

lkxstress.arm5 mirai.corebotnet.iot linux 18 hours ago

Mirai botnet malware binary

🌊 statist-browser-typed-client-hra.workplacer.events 20.9.1 and 6 siblings dns.tunnelingdelivery.download-execute ✓ javascript 1 day ago

Dropper downloads and executes native payload

🌊 virussign.com_b51901b8f26384e40cfe0a80ae210fd0.vir and 5 siblings shellobject.hijackpayload.encrypted 2 days ago

Kawaii-Unicorn VB6 dropper with .die hijack

🌊 sensi_hk.sh and 3 siblings botnet.iotdelivery.download-execute linux 2 days ago

IoT botnet dropper script

🌊 View Memo 5.11.21 and 3 siblings firefox 1 day ago

Obfuscated API key in browser extension

🌊 virussign.com_a01e7eea0525433185cb9e1eab723470.vir and 3 siblings shellobject.hijack 2 days ago

Kawaii-Unicorn VB6 dropper with shell hijack

🌊 Guard Plus 6.19.1 and 2 siblings firefox 1 day ago

Fake ad blocker, basketball data stealer

🌊 tinkoff-component-page-loader 20.8.2 and 2 siblings execution.native-binarydns.tunneling ✓ javascript 1 day ago

Trojanized library downloads and executes native payload

tracy/tracy v2.11.0 first seen anywhere script.dropperexecution.wsh 25,810,817 installs composer 1 day ago

petgraph 0.8.3 biggest blast radius trojanized.build-pipeline 443,963,343 installs crates 2 days ago

windows 0.48.0 keylog.hookfirewall.wfp 283,825,870 installs crates 2 days ago

zip 6.0.0 encrypt.native-locker 228,140,556 installs crates 2 days ago

Meow Mailer – Free SMTP, Everything Included 0.1.9 meow-mailer domain.brand-impersonation 2,664 installs wordpress 2 days ago

Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) 1.1.0 clink-gateway-for-woocommerce credential-theft.env 163 installs wordpress 2 days ago

xmlhttprequest-ssl 1.5.5 exfiltration.sensitive-data npm 2 days ago

docker.io/longhornio/longhorn-engine v1.11.2-amd64 trojanized.backdoorinterpreter.command container 2 days ago

Trojanized systemd library with backdoor

dqkis.jar dropper.staged-loadercredential.token java 2 days ago

Minecraft token stealer with encrypted dropper

KryptonPlus-LIISTA.jar credential.tokendropper.staged-loader java 2 days ago

Minecraft token stealer with encrypted dropper

vape v4 crack.jar obfuscation.multi-layercredential.token java 2 days ago

mpiorowski/late-sh v0.42.7 reverse-shell.dup github 1 day ago

Undercat037/aura-emerge v1.32.0 undercat037/aura-emerge delivery.pipeobfuscation.multi-layer github 2 days ago

clash-verge-rev/clash-verge-rev v2.5.2-Clash.Verge_2.5.2_aarch64.app tunnel.proxyload.runtime github 2 days ago

Extension Z 9.8.8 extension-z domain.brand-impersonationhttp.report 5 installs firefox 1 day ago

Exfiltrates data to external domain

advBR - Monitoramento Jurídico 3.8 advbr-monitoramento-jurídico 3 installs firefox 2 days ago

Extension downloads and executes native malware

firefox 154.0b1 domain.brand-impersonationip.spoof arch 1 day ago

https://github.com/ouijit/ouijit/releases/download/v1.5.0/ouijit-linux-x64.zip credential-theft.packagetheft.multi-store arch 1 day ago

blunderDB-linux-webkit2gtk 4.1-0.30.0 pack.detect arch 1 day ago

fun - Browser Extension 7.9.26 fun-browser-extension firefox 1 day ago

Steals crypto seed phrases via exfiltration

dnpcaahjbmabpacbdhnfjdincnkafjfm destroy.browser-storage chrome 1 day ago

mdcejhlefgkmjiepehgffkjpaekbceol impersonation.brand chrome 2 days ago

Hollow package impersonates legitimate project

kpmkikjpclolhodgckeogmiiaehpfjhl http.report chrome 2 days ago

Extension exfiltrates browsing data and credentials

cswap-pin 0.1.4 exploit.scanner python 1 day ago

cookiecutter-pypackage-gitlab 0.6.0 trojanized.package python 1 day ago

cswap-pin 0.1.3 exploit.scanner python 1 day ago

github.com/Zaeem20/FREE_PROXIES_LIST v0.0.0-20260802223625-9413b2f87a4e go 1 day ago

CI pipeline fetches and executes remote code

pkg:golang/google.golang.org/[email protected] trigger.activationformat.iso go 1 day ago

github.com/DataDog/datadog-agent/pkg/util/winutil v0.79.0 trojanize.system-utilitiesregistry.run-key go 2 days ago

file obfuscator.garble windows 2 days ago

Go shellcode loader with evasion

ws-Setup-Complete.exe obfuscator.garbleinjection.shellcode windows 2 days ago

Go loader with shellcode injection and obfuscation

file payload.sectionpack.section-anomaly windows 2 days ago

Packed PE with obfuscated loader

@openauthjs/openauth 0.4.3 credential-theft.env javascript 1 day ago

google-closure-compiler-windows 20260527.0.0 loader.native-reflectrat.config javascript 2 days ago

google-closure-compiler-windows 20260730.0.0 loader.native-reflectstaging.encrypted javascript 2 days ago

virussign.com_e339ab3e18106287c9e810daa05a3d60.vir upx.decompression-failedpack.runtime 2 days ago

Packed PE loader with dynamic API resolution

virussign.com_78b49bdf2a8f820dbf9997e7bb9f8460.vir cryptominer.genericMiner.May19 2 days ago

virussign.com_d8d8d42928290d036a50bc79039b6ae0.vir shellobject.hijackpe-tampering.corrupted-header 2 days ago

Kawaii-Unicorn trojan with file extension hijack

boatnet.arm7 linux.generic_threatMirai.Mar13 linux 2 days ago

Mddos.arm5 process.renameminer.runtime linux 2 days ago

XMRig cryptojacking malware payload

k.php account.createurl.external-ip linux 2 days ago

windows-sys 0.60.2 biggest blast radius firewall.wfp 1,344,061,720 installs crates 2 days ago

windows-sys 0.61.0 firewall.wfp 1,318,454,039 installs crates 2 days ago

adv 3.3.9-alpha.0.4787 pack.runtimebuild.github-actions 63,159 installs dotnet 2 days ago

Contains embedded malware dropper scripts

reqwest 0.12.20 615,136,944 installs crates 2 days ago

net/py-boto3 account.createwallet.desktop openbsd 2 days ago

https://download.jetbrains.com/toolbox/jetbrains-toolbox-3.6.3.86383.tar.gz credential.keyloggerformat.structured arch 2 days ago

v0.5.2.tar.gz channel.covert arch 2 days ago

https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_150.0.7871.181-1_amd64.deb domain.brand-impersonationformat.structured arch 2 days ago

kebafpphjokgalmnacbpokgodbnobbij chrome 2 days ago

Credential exfiltration to external server

peblippohhgkomkndbnpgbnpfpgolnel chrome 2 days ago

Embedded archive in extension

guardianhub 0.1.577 remote-command.dispatchenv.token python 2 days ago

Embedded private keys and admin remote control

vibefoundry 0.4.4 cmd.injection python 2 days ago

Web endpoint executes arbitrary shell commands

github.com/DataDog/datadog-agent/pkg/util/winutil v0.82.0-rc.9 trojanize.system-utilitiesregistry.run-key go 2 days ago

github.com/jomcgi/homelab v0.0.0-20260802011128-98a51c1d7942 reverse-shell.dupautomation.agent go 2 days ago

google.golang.org/api v0.259.0 domain.brand-impersonationtasking.filesystem go 2 days ago

pyouro 1.1.12 payload.loaderdebugger-detect.check ✓ python 2 days ago

DRM framework with anti-debug and obfuscation

the-sz.Trion screenshot.capture windows 2 days ago

Trion RAT malware with exfiltration

fsevents 1.1.3 hidden-payload.encodingwallet.desktop javascript 2 days ago

@a2a-js/sdk 1.0.1 dropper.download-execute javascript 2 days ago

@vercel/ncc 0.27.0 timing.timer javascript 2 days ago

v3.0.0.6 execution.download-execexecution.wsh 2 days ago