BlueTeamCoolTeam

Malware analysis and detection engineering for defenders

HOME
CATEGORIES
TAGS
ARCHIVES
ABOUT

Home Tags hvnc

Tag

hvnc 1

The "SharePoint Helper" That Was Really a Localhost Backdoor Jun 6, 2026

Recently Updated

The "SharePoint Helper" That Was Really a Localhost Backdoor
A Fake "SystemHealth" Service, a Pyarmor Wall, and Three Ways to Get Paid
A signed OneDrive, a fake note-taking app, and a payload hiding in a PNG: one ClickFix chain, five stages deep
Bring Your Own Node: a PowerShell stager, a blockchain dead-drop, and a RAT that runs on the real Node.js
The beacon that won't decrypt unless it beats AMSI: pulling apart a WMI-launched PowerShell loader

Trending Tags

application-control lolbin powershell c2 defense-evasion amsi-bypass clickfix constrained-language-mode javascript masquerading

© 2026 Luke Wilkinson. Some rights reserved.

Using the Chirpy theme for Jekyll.

Trending Tags

application-control lolbin powershell c2 defense-evasion amsi-bypass clickfix constrained-language-mode javascript masquerading

A new version of content is available.