Physmem2profit can be used to create a minidump of a target hosts' LSASS process by analysing physical memory remotely
-
Updated
Jul 27, 2022 - C#
#
credential-theft
Here are 20 public repositories matching this topic...
-
Updated
Feb 9, 2020 - PowerShell
Thumper is an open-source tripwire for the Shai-Hulud npm worm. Plant fake-but-realistic credentials where the worm scans - the instant one is read, you know the box might be breached. Free and built in the open by Jesta.
open-source npm security canary incident-response tripwire devsecops malware-detection honeytoken threat-detection credential-theft endpoint-security canarytokens supply-chain-security npm-security shai-hulud supply-chain-attack honeytokens
-
Updated
Aug 26, 2026 - Python
GitHub Action that detects the Shai-Hulud 2.0 (Nov 2025) and ChainDrop (Aug 2026) npm supply-chain attacks. Scans dependencies, lockfiles and CI workflows against a daily-updated database of 1,200+ compromised packages, flags malicious install scripts, TruffleHog secret theft and SHA1HULUD runners. SARIF output for GitHub Code Scanning.
nodejs npm security ioc sarif devsecops code-scanning malware-detection threat-detection credential-theft github-actions github-action dependency-scanning open-source-security supply-chain-security npm-security shai-hulud supply-chain-attack chaindrop shai-hulud-2
-
Updated
Sep 1, 2026 - TypeScript
This repo documents a vulnerability in Siri Shortcuts and Shared Web Credentials (SWC) allowing malformed payloads to persistently execute, trigger retry storms, bypass TLS validation, and request unauthorized entitlements. Confirmed on iOS 18.6.2 with potential iCloud-based propagation.
-
Updated
Mar 20, 2026
Android overlay attack & SMS OTP stealer PoC using AccessibilityService — security research only
android kotlin education proof-of-concept malware-analysis android-security mobile-security banking-trojan accessibility-service security-research credential-theft overlay-attack sms-interception otp-stealer
-
Updated
Feb 10, 2026 - Kotlin
Runtime dependency-behavior monitor for Node.js. Two engines: in-process telemetry + an out-of-process (strace) trust boundary that sees native egress & persistence. Defense-in-depth for npm supply-chain attacks — SARIF, GitHub Action, zero deps.
nodejs npm security supply-chain owasp ci-cd postinstall sarif devsecops threat-intelligence dependency-monitoring malware-detection runtime-monitoring credential-theft npm-audit github-actions zero-dependencies supply-chain-security backdoor-detection wall-of-shame
-
Updated
Aug 31, 2026 - JavaScript
Educational malware research - award-winning thesis on Windows credential theft and detection techniques
go windows golang detection malware cybersecurity educational malware-analysis malware-research information-security red-team security-research credential-theft infostealer
-
Updated
Jul 26, 2026 - Go
Analysis, IOCs, detection rules, and removal scripts for the ChatGPT Plus Free Trial cross-platform info-stealer (macOS + Windows)
ioc reverse-engineering cybersecurity malware-analysis yara-rules threat-intelligence security-research malware-removal mitre-attack credential-theft deno windows-malware clickfix sigma-rules info-stealer chatgpt-scam macos-malware amos-stealer
-
Updated
May 24, 2026 - YARA
Forensic dataset + live dashboard for the 2026-04-29 'A Mini Shai-Hulud has Appeared' npm supply-chain worm by TeamPCP. 1,117 dropbox repos, 22 compromised accounts, 47 IOCs across 14 kinds. Trojaned: @cap-js, mbt, @bitwarden/cli. C2 attribution to AS209101 IP Vendetta Inc. JSONL data · kinetic dashboard · CC-BY-4.0.
ioc incident-response dataset cybersecurity threat-hunting malware-analysis forensic-analysis threat-intelligence bitwarden indicators-of-compromise jsonl credential-theft supply-chain-security cap-js sap-security shai-hulud npm-worm teampcp mini-shai-hulud npm-supply-chain-attack
-
Updated
Jul 19, 2026 - Shell
Proof of Concept: NTLMv2 Hash Capture via Microsoft Teams onenote:// URI
-
Updated
Jun 16, 2026 - Python
A DLL injection of RdpThief.dll to perform API hooking and extract RDP credentials
-
Updated
Jun 4, 2024 - C++
Object-first file access control for Linux: make ~/.ssh, ~/.aws and other secrets readable only by the tools that own them. Enforced in-kernel with eBPF (BPF-LSM), in Rust. Early development.
linux rust security sandbox aya ebpf access-control lsm secrets-management credential-theft infostealer bpf-lsm
-
Updated
Sep 1, 2026 - Rust
Cross-platform personal browser credential DLP monitor. Linux: fanotify blocking | Windows: NtQueryInfo polling. Blocks infostealers from reading cookies/passwords in real-time.
security privacy anti-malware python-security dlp linux-security data-loss-prevention password-security credential-theft fanotify endpoint-security windows-security cookie-protection infostealer
-
Updated
Jun 25, 2026 - Python
AD (Active Directory) Service Account Manager is an enterprise-grade PowerShell framework that codifies identity lifecycle management and eliminates identity debt within Active Directory. It transitions organizations away from fragmented, manual service account management into a structured, audited, and automated governance model.
ad active-directory kerberos hardening msa shadow-admin service-account kerberos-authentication credential-theft kerberoasting sidhistory gmsa acl-audit as-rep-roasting adminsdholder
-
Updated
Mar 2, 2026 - PowerShell
Investigación técnica sobre vectores de ataque comunes en infraestructura cloud.
iaas cloud-computing cloud-infrastructure offensive-security privilege-escalation cloud-security credential-theft attack-vectors resource-exhaustion
-
Updated
Aug 1, 2026 - HTML
This case study documents a stealthy credential-harvesting technique in which the attacker used a lightweight binary (browserdump.exe) to extract stored credentials from browser cache files—specifically Chrome and Edge—without elevating privileges or triggering persistence indicators.
-
Updated
May 12, 2025 - Jupyter Notebook
Detect, remove, and recover from the PolinRider npm supply-chain malware that injects an obfuscated loader into JS/TS config files (macOS). Field-tested step-by-step guide.
nodejs macos npm security incident-response malware infosec malware-removal credential-theft supply-chain-security supply-chain-attack polinrider
-
Updated
Aug 17, 2026
🛡️ SkillsSafe: A security scanner for SKILL.md, MCP configs, and system prompts to detect exfiltration, shell injection, and hidden threats.”
-
Updated
Mar 13, 2026 - TypeScript
Threat-intel teardown + keyless live tracker of a multi-brand marketplace phishing-as-a-service (PhaaS) operation (Classiscam/Telekopye class) impersonating OLX, Subito, Kleinanzeigen & ~120 brands to steal card data + 3-D Secure/OTP. IOCs, kit analysis, detection signatures.
ioc otp osint incident-response reverse-engineering phishing dfir cybersecurity infosec malware-analysis fraud-prevention cti anti-fraud threat-intelligence phishing-kit credential-theft phaas classiscam telekopye marketplace-scam
-
Updated
Sep 1, 2026 - HTML
Add this topic to your repo
To associate your repository with the credential-theft topic, visit your repo's landing page and select "manage topics."