Aggregator

BamboozlEDR A comprehensive ETW (Event Tracing for Windows) event generation tool designed for testing and research purposes. BamboozlEDR

The post BamboozlEDR: New Tool Generates Realistic ETW Events to Test EDR Detection appeared first on Penetration Testing Tools.

For the PostHog team, developers of an open-source analytics platform, the recent npm-based attack has become the most

The post PostHog Hacked: Shai-Hulud 2.0 Worm Steals 25,000+ Developer Secrets via npm appeared first on Penetration Testing Tools.

The Israel Defense Forces (IDF) have prohibited senior commanders from using Android smartphones for official communications — from

The post Standardizing Security: IDF Bans Android, Mandates iPhone for Senior Commanders appeared first on Penetration Testing Tools.

The People’s Bank of China has once again made it unmistakably clear that its hardline stance on suppressing

The post PBOC Formally Classifies Stablecoins as Illegal Virtual Currency, Confirms Total Crypto Ban appeared first on Penetration Testing Tools.

Digital calendars have long been a convenient way to stay organized amid daily routines, yet new research from

The post 4 Million iOS Users at Risk: Abandoned Domains Weaponized for iCalendar Phishing appeared first on Penetration Testing Tools.

The American manufacturer of aerospace and defense components ADC Aerospace has come under scrutiny following a potential cyberattack:

The post Play Ransomware Claims Breach of Defense Contractor ADC Aerospace, Stealing Client Data appeared first on Penetration Testing Tools.

North Korea’s Contagious Interview malware campaign continues to escalate its pressure on the JavaScript-development ecosystem. Threat actors affiliated

The post N. Korea’s Contagious Interview Campaign Targets Job Seekers with 197 Malicious npm Packages appeared first on Penetration Testing Tools.

North Korea’s Lazarus hacking collective is intensifying its targeted phishing campaigns against cryptocurrency platforms and individual investors, amassing

The post Lazarus Group Stole $1.4B in Crypto; Will Use AI & Deepfakes for 2026 Attacks appeared first on Penetration Testing Tools.

The GrapheneOS mobile operating-system project has announced that it is severing ties with OVHcloud, expressing concern that French

The post GrapheneOS Ditches OVHcloud, Citing French Jurisdiction and Encryption Backdoor Pressure appeared first on Penetration Testing Tools.

Police in South Korea have detained four individuals in connection with the hacking of more than 120,000 IP

The post South Korea Arrests 4 for Hacking 120,000 IP Cameras to Mass-Produce Illegal Videos appeared first on Penetration Testing Tools.

Poetry has, quite unexpectedly, become a weapon for attacking artificial-intelligence systems. A new study has revealed that the

The post Poetry is the New Hack: ‘Adversarial Poetry’ Bypasses 62% of LLM Safety Filters appeared first on Penetration Testing Tools.

The KDE developer community has now definitively charted the future of its graphical environment: support for X11 will

The post KDE Commits to Wayland: X11 Support Will Be Fully Dropped in Plasma 6.8 appeared first on Penetration Testing Tools.

Against the backdrop of a surge in schemes involving the remote manipulation of infected devices, a new tool

The post Albiriox: New Android MaaS Uses VNC for Covert Remote Bank Fraud appeared first on Penetration Testing Tools.

WormGPT 4、KawaiiGPT等无限制大型语言模型的恶意代码生成能力正不断强化，已能输出可直接运行的勒索软件加密程序及横向移动脚本，成为网络犯罪分子的得力工具。

Unit42研究团队对这两款模型开展了专项测试。目前，这两款模型通过付费订阅或免费本地部署的方式，在网络犯罪圈的使用率正持续上升。

WormGPT 4：专攻网络犯罪的付费无限制模型

WormGPT原型最早于2023年出现，但据报道该项目同年便停止运营。而WormGPT 4作为该品牌的“回归之作”，于今年9月重新出现，采用订阅制模式——月费50美元或终身使用权220美元。这款模型堪称“无审查版ChatGPT”，专为网络犯罪场景训练，不受内容安全限制。

Unit42研究人员测试了其勒索软件代码生成能力，结果显示该模型可产出能加密Windows主机上所有PDF文件的PowerShell脚本。该脚本支持自定义配置：可指定目标文件路径与扩展名，采用AES-256算法进行数据加密，更内置了通过Tor网络窃取数据的选项，完全贴合真实网络攻击的操作需求。

生成的数据加密脚本

此外，研究人员通过提示词引导，让WormGPT 4生成了一份“极具威慑力且话术老练的勒索信”——信中宣称采用“军用级加密技术”，要求受害者在72小时内支付赎金，否则赎金将翻倍。

生成的勒索信

研究人员指出，“WormGPT 4在商业电子邮件妥协（BEC）和钓鱼攻击中具备可信的语言操控能力”，这使得技术水平较低的攻击者也能实施以往仅由资深威胁行为者才能完成的复杂攻击。

KawaiiGPT：社区驱动的免费恶意工具

KawaiiGPT是今年7月被发现的另一款恶意大模型，作为免费的社区驱动项目，其核心能力包括生成高质量钓鱼邮件，以及自动化横向移动所需的即开即用脚本。Unit42研究人员测试了其2.5版本，发现该模型在Linux系统上的部署仅需5分钟。

在KawaiiGPT上生成的钓鱼邮件

多场景恶意脚本生成测试

研究人员通过提示词指令，验证了KawaiiGPT的四大核心能力：

1. 生成鱼叉式钓鱼邮件：支持逼真的域名伪造，内置凭证窃取链接；

2. 横向移动Python脚本：利用paramiko SSH库连接目标主机，通过exec_command()函数远程执行命令；

3. 数据窃取与外发脚本：借助os.walk函数递归遍历Windows文件系统查找目标文件，通过smtplib库打包数据并发送至攻击者控制的邮箱地址；

4. 定制化勒索信生成：可灵活配置付款说明、时限要求及常见的加密强度宣称话术。

数据泄露功能

尽管KawaiiGPT未能像WormGPT 4那样生成完整的加密程序或功能性勒索软件载荷，但研究人员警示，其命令执行能力足以让攻击者实现权限提升、数据窃取，以及投放并运行额外恶意载荷的操作。

这两款恶意大模型均拥有专属Telegram频道，各频道订阅成员已达数百人，社区成员在其中交流攻击技巧与使用经验。

Unit42研究团队强调：“对这两款模型的分析证实，攻击者已在实际威胁场景中积极运用恶意大模型，这类工具已不再是理论层面的威胁。”

值得警惕的是，这些工具显著降低了网络攻击的技术门槛：缺乏经验的攻击者借助它们，能够规模化实施更高级别的攻击，大幅缩短了目标侦察与工具开发的时间；同时，模型生成的钓鱼诱饵语言流畅自然、专业性强，摆脱了传统诈骗邮件中常见的语法错误，更易诱使受害者上当。