The beacon that won't decrypt unless it beats AMSI: pulling apart a WMI-launched PowerShell loader
A WMI-launched PowerShell loader with reflection AMSI/ETW bypass and a payload that only decrypts if its own AMSI bypass succeeded first.
BlueTeamCoolTeam
Bring Your Own Node: a PowerShell stager, a blockchain dead-drop, and a RAT that runs on the real Node.js
A PowerShell stager drops the legitimate Node.js runtime, runs a JavaScript RAT under it, and resolves its C2 domain from a TON blockchain smart contract.
A signed OneDrive, a fake note-taking app, and a payload hiding in a PNG: one ClickFix chain, five stages deep
A ClickFix lure drops a 145 MB Electron flomo app. The RAT runs a signed OneDriveLauncher that sideloads a trojanized DLL to decrypt a PNG-wrapped payload.
Seven layers of obfuscation, one 1970s LOLBIN: pulling apart a ClickFix chain through finger.exe
A ClickFix loader using finger.exe over TCP/79 to drop IronPython and an in-process x86 shellcode beacon.
Twelve layers of obfuscation, one AMSI patch: pulling apart a ClickFix mshta loader
A ClickFix campaign drops a 2.4 MB polyglot from prism-vertex[.]com that looks like an MSIX package but parses as an HTA when mshta opens it.
A driver that wasn't a driver: dissecting a steganographic PowerShell beacon
A 3.7 MB log-line file in System32\drivers\, a tiny PowerShell read-decode-execute, and an HTTP beacon that pulls its capability live.