Physmem2profit can be used to create a minidump of a target hosts' LSASS process by analysing physical memory remotely
-
Updated
Jul 27, 2022 - C#
#
credential-theft
Here are 18 public repositories matching this topic...
-
Updated
Feb 9, 2020 - PowerShell
Detect npm packages compromised in the Shai-Hulud 2.0 supply chain attack (Nov 2025). Scans for 790+ malicious packages, suspicious scripts, TruffleHog activity, SHA1HULUD runners, and secrets exfiltration. GitHub Action with SARIF support.
nodejs npm security sarif devsecops vulnerability-scanner malware-detection credential-theft github-actions open-source-security supply-chain-security sarif-report package-security shai-hulud shai-hulud-detector shai-hulud-attack shai-hulud2-detector shai-hulud2 shai-hulud2-inspector sha1-hulud
-
Updated
Jun 28, 2026 - TypeScript
Thumper is an open-source tripwire for the Shai-Hulud npm worm. Plant fake-but-realistic credentials where the worm scans - the instant one is read, you know the box might be breached. Free and built in the open by Jesta.
open-source npm security canary incident-response tripwire devsecops malware-detection honeytoken threat-detection credential-theft endpoint-security canarytokens supply-chain-security npm-security shai-hulud supply-chain-attack honeytokens
-
Updated
Jun 28, 2026 - Python
This repo documents a vulnerability in Siri Shortcuts and Shared Web Credentials (SWC) allowing malformed payloads to persistently execute, trigger retry storms, bypass TLS validation, and request unauthorized entitlements. Confirmed on iOS 18.6.2 with potential iCloud-based propagation.
-
Updated
Mar 20, 2026
Android overlay attack & SMS OTP stealer PoC using AccessibilityService — security research only
android kotlin education proof-of-concept malware-analysis android-security mobile-security banking-trojan accessibility-service security-research credential-theft overlay-attack sms-interception otp-stealer
-
Updated
Feb 10, 2026 - Kotlin
Runtime dependency-behavior monitor for Node.js. Two engines: in-process telemetry + an out-of-process (strace) trust boundary that sees native egress & persistence. Defense-in-depth for npm supply-chain attacks — SARIF, GitHub Action, zero deps.
nodejs npm security supply-chain owasp ci-cd postinstall sarif devsecops threat-intelligence dependency-monitoring malware-detection runtime-monitoring credential-theft npm-audit github-actions zero-dependencies supply-chain-security backdoor-detection wall-of-shame
-
Updated
Jun 28, 2026 - JavaScript
Analysis, IOCs, detection rules, and removal scripts for the ChatGPT Plus Free Trial cross-platform info-stealer (macOS + Windows)
ioc reverse-engineering cybersecurity malware-analysis yara-rules threat-intelligence security-research malware-removal mitre-attack credential-theft deno windows-malware clickfix sigma-rules info-stealer chatgpt-scam macos-malware amos-stealer
-
Updated
May 24, 2026 - YARA
Proof of Concept: NTLMv2 Hash Capture via Microsoft Teams onenote:// URI
-
Updated
Jun 16, 2026 - Python
Forensic dataset + live dashboard for the 2026-04-29 'A Mini Shai-Hulud has Appeared' npm supply-chain worm by TeamPCP. 1,117 dropbox repos, 22 compromised accounts, 47 IOCs across 14 kinds. Trojaned: @cap-js, mbt, @bitwarden/cli. C2 attribution to AS209101 IP Vendetta Inc. JSONL data · kinetic dashboard · CC-BY-4.0.
ioc incident-response dataset cybersecurity threat-hunting malware-analysis forensic-analysis threat-intelligence bitwarden indicators-of-compromise jsonl credential-theft supply-chain-security cap-js sap-security shai-hulud npm-worm teampcp mini-shai-hulud npm-supply-chain-attack
-
Updated
Apr 29, 2026 - Shell
A DLL injection of RdpThief.dll to perform API hooking and extract RDP credentials
-
Updated
Jun 4, 2024 - C++
Retrieve user credentials via the Windows API and save them to a file.
grabber windows-api stealer credential-theft cookie-logger cryptowallet stealer-builder grabber-password crypto-stealer windows-credentials credential-harvesting credentials-stealer credentials-grabber
-
Updated
Jun 28, 2026 - C++
This case study documents a stealthy credential-harvesting technique in which the attacker used a lightweight binary (browserdump.exe) to extract stored credentials from browser cache files—specifically Chrome and Edge—without elevating privileges or triggering persistence indicators.
-
Updated
May 12, 2025 - Jupyter Notebook
Cross-platform personal browser credential DLP monitor. Linux: fanotify blocking | Windows: NtQueryInfo polling. Blocks infostealers from reading cookies/passwords in real-time.
security privacy anti-malware python-security dlp linux-security data-loss-prevention password-security credential-theft fanotify endpoint-security windows-security cookie-protection infostealer
-
Updated
Jun 25, 2026 - Python
AD (Active Directory) Service Account Manager is an enterprise-grade PowerShell framework that codifies identity lifecycle management and eliminates identity debt within Active Directory. It transitions organizations away from fragmented, manual service account management into a structured, audited, and automated governance model.
ad active-directory kerberos hardening msa shadow-admin service-account kerberos-authentication credential-theft kerberoasting sidhistory gmsa acl-audit as-rep-roasting adminsdholder
-
Updated
Mar 2, 2026 - PowerShell
🛡️ SkillsSafe: A security scanner for SKILL.md, MCP configs, and system prompts to detect exfiltration, shell injection, and hidden threats.”
-
Updated
Mar 13, 2026 - TypeScript
Threat-intel teardown + keyless live tracker of a multi-brand marketplace phishing-as-a-service (PhaaS) operation (Classiscam/Telekopye class) impersonating OLX, Subito, Kleinanzeigen & ~120 brands to steal card data + 3-D Secure/OTP. IOCs, kit analysis, detection signatures.
ioc otp osint incident-response reverse-engineering phishing dfir cybersecurity infosec malware-analysis fraud-prevention cti anti-fraud threat-intelligence phishing-kit credential-theft phaas classiscam telekopye marketplace-scam
-
Updated
Jun 29, 2026 - HTML
🛡️ Guard your projects against the Shai-Hulud 2.0 npm supply chain attack with our secure detection tool for safer development.
nodejs npm security sarif devsecops vulnerability-scanner malware-detection credential-theft open-source-security supply-chain-security sarif-report package-security shai-hulud shai-hulud-attack shai-hulud2-detector shai-hulud2 shai-hulud2-inspector sha1-hulud
-
Updated
Jun 29, 2026 - TypeScript
Improve this page
Add a description, image, and links to the credential-theft topic page so that developers can more easily learn about it.
Add this topic to your repo
To associate your repository with the credential-theft topic, visit your repo's landing page and select "manage topics."