#payload

Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs

Oct 1, 2026 // 11:41

Threat actors have been observed exploiting a critical pre-authentication command injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway to drop web shells and attempt […]

GitHub Actions re-enabled with Mini Shai-Hulud payload still active

Sep 26, 2026 // 17:36

Two third-party GitHub Actions previously compromised in a Mini Shai-Hulud campaign were re-enabled by their maintainer and remained accessible for more than a week despite […]

PamStealer macOS Malware Adds Live C2 Payload Decryption and Multi-Layer Persistence

Sep 25, 2026 // 16:27

Cybersecurity researchers have flagged a new version of PamStealer that ensures that the main payload can only be recovered using a server-side decryption chain. The […]

Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner-Like Payload

Aug 26, 2026 // 11:20

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday warned of active exploitation efforts targeting a recently patched critical security flaw impacting Gitea. The […]

DevMan RaaS Portal Centralizes Payload Builds, Victim Management, and Affiliate Payouts

Jul 25, 2026 // 18:31

The operators of the DevMan ransomware-as-a-service (RaaS) scheme are maintaining a dedicated web platform that offers affiliates the ability to build payloads, oversee earnings, and […]

DevMan RaaS Portal Centralizes Payload Builds, Victim Management, and Affiliate Payouts

Jul 25, 2026 // 13:38

The operators of the DevMan ransomware-as-a-service (RaaS) scheme are maintaining a dedicated web platform that offers affiliates the ability to build payloads, oversee earnings, and […]

HollowByte DDoS flaw bloats OpenSSL server memory with 11-byte payload

Jul 18, 2026 // 00:37

A vulnerability dubbed HollowByte allows unauthenticated attackers to trigger a denial-of-service (DoS) condition on OpenSSL servers with a malicious payload of just 11 bytes. The […]