🎯 Command and Scripting Interpreter

The items that name it 14

• Pretty Themes, Hidden Loaders: GlassWorm-Linked Extensions Span VS Code Marketplace and Open VSX
  writeup2026-10-02It is written here as Command and Scripting Interpreter: JavaScript.

  Execution of malicious JavaScript via eval() and vm.Script in Node.js context

• Phishing Abuses RMM Tools for Persistent Access
  writeup2026-09-29It is written here as Command and Scripting Interpreter: PowerShell.

  MSP360 RMM.Agent.exe service launched PowerShell to download and install ConnectWise ScreenConnect.

• Threat Actors Abuse IronPython to Deliver CastleLoader/CastleRAT
  writeup2026-09-17It is written here as Command and Scripting Interpreter: Python.

  Threat actors abuse IronPython interpreter at different stages of the attack lifecycle

• Socket: Malicious Extensions Drain Axiom Trade and Padre Crypto Sessions
  writeup2026-09-12It is written here as Command and Scripting Interpreter: JavaScript.

  Malicious module vamp/axiom-fetch-intercept.js runs JavaScript inside authenticated session pages

• AI Development and Agentic Security Labs
  course2026-08-21
• MAJINAHANASHI RANSOMWARE: Yet Another Japanese Locker
  writeup2026-08-14It is written here as Command and Scripting Interpreter (T1059).

  Command execution via a thin wrapper that builds command lines and calls CreateProcessA

• Socket: GitHub Actions Abuse Powers Distributed cPanel/WHM Exploitation Campaign
  writeup2026-07-23It is written here as Command and Scripting Interpreter: Unix Shell.

  Malicious workflow shell commands downloading and executing payloads on runners.

• Socket: Operation Muck and Load
  writeup2026-07-16It is written here as Command and Scripting Interpreter: PowerShell.

  Hidden PowerShell execution used at multiple stages of the loader chain.

• Socket: 11 Malicious NuGet Tools Pose as Game Cheats
  writeup2026-07-15It is written here as Command and Scripting Interpreter: PowerShell.

  Hidden elevated PowerShell process runs 'Start-Service w32time; w32tm /resync'

• Socket: Chrome and Firefox VPN Extensions Add Clipboard Stealers via Malicious Updates
  writeup2026-06-30It is written here as Command and Scripting Interpreter: JavaScript.

  Clipboard-stealing logic implemented in JavaScript (scripts/version.js and scripts/background.js).

• Socket: Famous Chollima Targets PHP Developers via Compromised Packagist Package
  writeup2026-06-01It is written here as Command and Scripting Interpreter: JavaScript.

  Obfuscated JavaScript payload executed within Node.js

• Socket: Popular Go Decimal Library Targeted by Long-Running Typosquat with DNS Backdoor
  writeup2026-05-20

  TXT record values passed directly to os/exec.Command and executed via CombinedOutput()

• BufferZoneCorp Malicious Gems & Go Modules
  writeup2026-05-06It is written here as Command and Scripting Interpreter: Unix Shell.
• Zero-Click RCE in MCP
  writeup2026-05-06It is written here as Command and Scripting Interpreter: Python.

  Python execution allow-listed in Cursor config so the Gist executes automatically when retrieved