Daily Writeups
@Daily_Writeups
3.92K subscribers
4 photos
135K links
Daily Bug Bounty / Cybersecurity Writeups
Source Code : https://github.com/Spix0r/writeup-miner
Download Telegram
About
Blog
Apps
Platform
Join
Daily Writeups
3.92K subscribers
Daily Writeups
⤷ Title: An Investigation of AMSI Evasion
════════════════════════
𐀪 Author: John Ford
════════════════════════
ⴵ Time: Wed, 08 Oct 2025 22:41:17 GMT
════════════════════════
⌗ Tags: #defense_evasion #powershell #penetration_testing #amsi
Medium
An Investigation of AMSI Evasion
To skip all the AMSI and reflective loading background, jump to the Practical Tips for Penetration Testers section.
23 views
Daily Writeups
⤷ Title: Amatera Stealer Campaign Uses ClickFix to Deploy Malware, Bypassing EDR by Patching AMSI in Memory
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Tue, 18 Nov 2025 00:10:03 +0000
════════════════════════
⌗ Tags: #Malware #Amatera Stealer #AMSI Bypass #ClickFix #Credential Theft #NetSupport RAT #powershell #Pure Crypter #WoW64 syscalls
Daily CyberSecurity
Amatera Stealer Campaign Uses ClickFix to Deploy Malware, Bypassing EDR by Patching AMSI in Memory
eSentire’s Threat Response Unit (TRU) has uncovered a widespread malware operation leveraging a deceptive social-engineering technique known as ClickFix to deliver a newly rebranded version of the…
21 views
Daily Writeups
⤷ Title: LazyHook: New Framework Uses Hardware Breakpoints to Bypass EDR Stealthily
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Sat, 13 Dec 2025 10:39:52 +0000
════════════════════════
⌗ Tags: #Open Source Tool #AMSI Bypass #cybersecurity #EDR evasion #Hardware Breakpoint #Hooking #LazyHook #Stealth #System Call Interception #Windows Security
Penetration Testing Tools
LazyHook: New Framework Uses Hardware Breakpoints to Bypass EDR Stealthily
LazyHook is a new open-source framework using hardware breakpoints and SEH to intercept system calls and execute code stealthily, bypassing memory integrity and EDR checks.
77 views
Daily Writeups
⤷ Title: Ransomware Groups Pivot: The Rise of Weyhro C2, a New Advanced Command-and-Control Platform
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Wed, 17 Dec 2025 04:37:38 +0000
════════════════════════
⌗ Tags: #Cybercriminals #AMSI Bypass #Command and Control #cybercrime #cybersecurity #evasion techniques #HVNC #Memory_Only Malware #ransomware #threat intelligence #Weyhro C2
Penetration Testing Tools
Ransomware Groups Pivot: The Rise of Weyhro C2, a New Advanced Command-and-Control Platform
Within cybercriminal circles, the emergence of a new command-and-control framework known as Weyhro C2 has been observed. Its
10 views
Daily Writeups
⤷ Title: Founding: The Next-Gen Loader Generator for Advanced Evasion
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Tue, 23 Dec 2025 03:21:55 +0000
════════════════════════
⌗ Tags: #Open Source Tool #AMSI Bypass #Cybersecurity 2025 #ETW Blinding #Founding #Indirect Syscalls #Malware Evasion #Obfuscation #red teaming #Sandbox Evasion #shellcode
Information Security News
Founding: The Next-Gen Loader Generator for Advanced Evasion
Founding is a tool that processes shellcode in .bin, .exe, or .dll formats, applying advanced obfuscation or encryption techniques to generate stealthy binaries with sophisticated execution method…
35 views
Daily Writeups
⤷ Title: The Ghost in the Machine: Master Stealth with the Orsted C2 Framework
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Fri, 26 Dec 2025 02:44:26 +0000
════════════════════════
⌗ Tags: #Open Source Tool #AMSI Evasion #Command and Control #cybersecurity #Go_lang #Ligolo_ng #Orsted C2 #Penetration Testing #post_exploitation #red teaming #Sandbox Deception
Penetration Testing Tools
The Ghost in the Machine: Master Stealth with the Orsted C2 Framework
Orsted C2 is a modular Go framework featuring sandbox deception, AMSI/ETW evasion, and native Ligolo-ng pivoting for advanced red team simulations.
36 views
Daily Writeups
⤷ Title: Amsi’yi anlamak
════════════════════════
𐀪 Author: Ege
════════════════════════
ⴵ Time: Mon, 12 Jan 2026 07:05:55 GMT
════════════════════════
⌗ Tags: #hacking #cybersecurity #siber_guvenlik #reverse_engineering #amsi
Medium
Amsi’yi anlamak
Anti Malware Scan İnterface. Winows üzerinde verilen api kaynağıdır. Amsi sayesinde çalışacak kod , komut ve uygulamaların çalışmadan önce…
13 views
Daily Writeups
⤷ Title: Bypassing AMSI
════════════════════════
𐀪 Author: z3l3v
════════════════════════
ⴵ Time: Thu, 12 Mar 2026 20:40:08 GMT
════════════════════════
⌗ Tags: #amsi_bypas #windows_defender #ethical_hacking #red_team #windows
Medium
Bypassing AMSI
I recently began reviewing some material to reinforce my understanding in some areas. During a session where I was practicing File Transfer…
51 views
Daily Writeups
⤷ Title: The Invisible Thread: Inside the Multi-Stage Python Injection Powering VioletRAT
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Sat, 14 Mar 2026 07:08:06 +0000
════════════════════════
⌗ Tags: #Malware #.NET CLR Hosting #AMSI Bypass #Cyber Security 2026 #malware analysis #Process Hollowing #Python injection #RAT #shellcode #SonicWall #VioletRAT
Information Security News
The Invisible Thread: Inside the Multi-Stage Python Injection Powering VioletRAT
Security vanguards at SonicWall have unmasked a nascent campaign disseminating the VioletRAT malware. This offensive orchestrates a multi-tiered delivery sequence and a sophisticated Python-based …
25 views
Daily Writeups
⤷ Title: STX RAT: The New Financial Predator Hiding in the “Start of Text”
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 13 Apr 2026 09:00:35 +0000
════════════════════════
⌗ Tags: #Malware #AMSI Ghosting #encryption #eSentire #Financial Cybersecurity #HVNC #infosec #malware #rat #Stealth Malware #STX RAT #threat intelligence
Daily CyberSecurity
STX RAT: The New Financial Predator Hiding in the "Start of Text"
eSentire TRU uncovers STX RAT, a modular Trojan targeting finance with HVNC, AMSI Ghosting, and advanced encryption. Secure your perimeter—learn how it works.
10 views
Daily Writeups
⤷ Title: New “PowMix” Botnet Preys on Czech Workforce with Lure of Compliance
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 20 Apr 2026 09:11:43 +0000
════════════════════════
⌗ Tags: #Malware #AMSI Bypass #botnet #Cisco Talos #cyber_espionage #Czech Republic #EDEKA Phishing #Heroku Abuse #infosec #Malware Analysis #PowerShell Malware #PowMix #REST API Mimicry
Daily CyberSecurity
New "PowMix" Botnet Preys on Czech Workforce with Lure of Compliance
Cisco Talos uncovers PowMix, a stealthy botnet targeting Czech HR via AMSI bypass and Heroku-hosted C2. Learn how this malware evades modern EDR systems.
26 views
Daily Writeups
⤷ Title: AI Hype Hijacked: How a Fake Claude Installer Blinds Windows Security
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Tue, 21 Apr 2026 06:30:25 +0000
════════════════════════
⌗ Tags: #Malware #AMSI Bypass #Claude AI #ClickFix #cybersecurity #infosec #malware #mshta.exe #MSIX #phishing #powershell #Rapid7
Daily CyberSecurity
AI Hype Hijacked: How a Fake Claude Installer Blinds Windows Security
Rapid7 uncovers a fake Claude AI installer using ClickFix techniques to bypass AMSI and inject shellcode. Stay safe from this sophisticated AI-themed threat.
23 views
Daily Writeups
⤷ Title: AMSI: Bypass Methods Every Red Teamer Needs
════════════════════════
𐀪 Author: Victor
════════════════════════
ⴵ Time: Wed, 29 Apr 2026 17:17:27 GMT
════════════════════════
⌗ Tags: #cybersecurity #red_teaming #hacking #amsi_bypas #malware_development
11 views
Daily Writeups
⤷ Title: The InstallFix Trap: Fake Claude AI Google Ads Drop Fileless RedLine Malware on Developers
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Fri, 08 May 2026 06:11:33 +0000
════════════════════════
⌗ Tags: #Malware #AMSI Bypass #Anthropic #Claude AI #ClickFix #cybersecurity #Fileless Malware #Google Ads Phishing #infosec #InstallFix #Redline stealer #Threat Intel
Daily CyberSecurity
The InstallFix Trap: Fake Claude AI Google Ads Drop Fileless RedLine Malware on Developers
Beware of InstallFix: Fake Claude AI Google Ads trick users into running fileless scripts that deploy RedLine Stealer to steal passwords and crypto.
32 views
Daily Writeups
⤷ Title: Weaponized JPEG Payload Deploys Trojanized ScreenConnect for Covert Espionage
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Thu, 14 May 2026 07:01:10 +0000
════════════════════════
⌗ Tags: #Cybercriminals #AMSI Bypass #ConnectWise #Cyber Security #Cyfirma #infosec #JPEG Exploit #Operation SilentCanvas #PowerShell Malware #ScreenConnect #Trojan #UAC bypass
Daily CyberSecurity
Weaponized JPEG Payload Deploys Trojanized ScreenConnect for Covert Espionage
CYFIRMA warns of Operation SilentCanvas: A weaponized JPEG delivers trojanized ScreenConnect, bypassing AMSI and UAC for full-system surveillance. Stay alert!
11 views
Daily Writeups
⤷ Title: Hackers Use PyInstaller and AMSI Patching to Deliver XWorm RAT v7.4
════════════════════════
𐀪 Author: Deeba Ahmed
════════════════════════
ⴵ Time: Fri, 15 May 2026 16:42:58 +0000
════════════════════════
⌗ Tags: #Security #Malware #Scams and Fraud #AMSI #Cyber Attack #Cybersecurity #Point Wild #PyInstaller #RAT #XWorm #XWorm 7.4
Hackread
Hackers Use PyInstaller and AMSI Patching to Deliver XWorm RAT v7.4
Hackers are hiding XWorm malware in PyInstaller files to bypass Windows security, steal data and remotely control devices through ads.
39 views
Daily Writeups
⤷ Title: CountLoader Malware Weaponizes EtherHiding to Deploy Stealth Crypto Clippers
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 18 May 2026 09:15:54 +0000
════════════════════════
⌗ Tags: #Malware #AMSI Bypass #CountLoader #Crypto theft #Cryptocurrency Clipper #Cyber Security #EtherHiding #Fileless Malware #infosec #McAfee Labs #threat intelligence
Daily CyberSecurity
CountLoader Malware Weaponizes EtherHiding to Deploy Stealth Crypto Clippers
McAfee Labs exposes a massive CountLoader campaign using EtherHiding and AMSI bypass to drop stealthy cryptocurrency clippers. Secure your assets!
20 views
Daily Writeups
⤷ Title: Multi-Stage PyInstaller Loader Weaponizes AMSI Patching to Deploy XWorm RAT
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 20 May 2026 06:13:42 +0000
════════════════════════
⌗ Tags: #Malware #AMSI Bypass #Cyber Security #defense evasion #infosec #Malware Analysis #Point Wild #PyInstaller Loader #rat #Remote Access Trojan #VirtualProtect #XWorm
Daily CyberSecurity
Multi-Stage PyInstaller Loader Weaponizes AMSI Patching to Deploy XWorm RAT
Point Wild exposes a sophisticated PyInstaller loader using in-memory AMSI patching and SHA-512 decryption to drop XWorm V7.4. Patch now!
15 views
Daily Writeups
⤷ Title: Under the PyInstaller Mask: Point Wild Exposes XWorm V7.4 Stealth Loader and AMSI Bypass
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Wed, 20 May 2026 07:49:06 +0000
════════════════════════
⌗ Tags: #Malware #.NET Reflection Plugins #AES Encrypted C2 Configuration #AMSI Bypass In_Memory Execution #Fileless Remote Administrative Trojan #Hidden System File Attributes #Point Wild Threat Intelligence #PyInstaller Loader Forensic #Runtime Windows API Resolving #Win.Kernel_Svc_AJ8iOw.exe #XWorm V7.4 Malware
Information Security News
Under the PyInstaller Mask: Point Wild Exposes XWorm V7.4 Stealth Loader and AMSI Bypass - Information Security News
Threat intelligence architects at Point Wild have dissectively mapped a contemporary XWorm V7.4 infection pipeline, demonstrating how a seemingly innocuous, Python-based installation package systematically mutates into a formidable remote administrative implant.…
25 views
Daily Writeups
⤷ Title: CrySome RAT Spread Through Fake Freight Rate Confirmation Phishing
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Wed, 15 Jul 2026 08:30:03 +0000
════════════════════════
⌗ Tags: #Malware #AMSI Bypass #Credential Theft #CrySome RAT #phishing attack #Remote Access Trojan #WinDefCtl
Daily CyberSecurity
CrySome RAT Spread Through Fake Freight Rate Confirmation Phishing
Malware family CrySome RAT, a .NET remote access trojan Threat actor Not named; no confirmed attribution Target / victims Windows users in freight and logistics roles (single triaged incident) Del…
14 views