Welcome to BlueTeamCoolTeam
So this is a thing now. BlueTeamCoolTeam is a personal blog where I’ll be publishing hands-on write-ups of real malware samples and incidents — the kind that show up on a Monday morning when someb...
BlueTeamCoolTeam
3,015 Hacked WordPress Sites Later, I Think I Found the Front Door
A theory: 52.4% of 3,015 compromised WordPress sites run the exact version that patched wp2shell, a pre-auth RCE chain - and why that's not a coincidence.
ClickFix in 2026: Eight Ways to Start the Same Attack
ClickFix isn't a malware family - it's a grammar with two variables: which binary runs, and how its name is obfuscated. Eight confirmed vectors, reproducible.
The ClickFix Stealer That Makes Microsoft Edge Steal From Itself
A ClickFix stealer padded to 842MB that resolves its C2 from a Telegram bio and spawns a real Edge browser to beat App-Bound Encryption.
Kovraxis: A Go Stealer That Reads Its C2 Address Off a Steam Profile
A Go-compiled Windows stealer hides its C2 address entirely, then reads it live from a Telegram channel bio and a Steam profile.
Another day, another 1,738 compromised websites: ClickFix keeps leaning on EtherHiding for C2
ClickFix keeps leaning on EtherHiding for C2 - combined with a prior investigation, this now accounts for over 3,500 compromised sites.
The ledger keeps talking: mapping five EtherHiding operators, two kit families, and 1,829 confirmed hacked websites
A second EtherHiding contract, a funding link, and a fully revalidated victim count: 1,829 confirmed hacked websites across two distinct kit families.
No File, No Fixed C2: Inside NetCon, a WMI Backdoor That Reads Its Command Server Off the Blockchain
A JScript backdoor persists as a WMI ActiveScriptEventConsumer with no file on disk, resolving its C2 address by reading Ethereum smart-contract storage.
Reading the ledger: how one Polygon smart contract exposed three ClickFix crews and 153 confirmed hacked websites
A ClickFix DLL side-load traced through a Polygon smart contract (EtherHiding) to 18 C2 domains and 153 confirmed hacked sites across three operators.
feintnet: I got tired of FakeNet-NG not running on my ARM box, so I built my own
FakeNet-NG's WinDivert driver wouldn't load on my ARM Windows box, so I built feintnet: a single Go binary that fakes DNS, TLS, and C2 for malware analysis.