Latest
Blog
A signed “Abe Office” helper that opens your browser behind your back
A signed "Abe Office workstation helper" is a modular RAT with a hidden desktop that reuses the victim's logged-in browsers and a stealer that defeats Chrome's App-Bound Encryption.…
A signed “CookUp” recipe-app installer that lets its server pick the victims
An EV-signed Go installer for a fake recipe app installs a harmless decoy, but hides a loader that only downloads and runs its in-memory DLL when the server's…
A signed “Marvell RAID utility” that builds its malware with Microsoft’s own compiler
A fake Marvell RAID installer, signed with a brand-new individual certificate, runs a renamed Microsoft MSBuild that loads a tampered Microsoft library, decrypts a hidden 16.6 MB program…
A signed “Google Workspace” installer that doesn’t know where it’s going
An EV-signed MSIX posing as Google Workspace carries no server address: a tiny .appinstaller file on workspacedriver[.]live supplies it, along with Microsoft's real runtime, and the app then…
A signed “Funding Application Form” that hands your desktop to a plugin RAT
An EV-signed "Funding Application Form" side-loads a malicious DLL through a Ubisoft-signed DirectX tool and installs a plugin RAT. In a long sandbox run, a live operator added…
A signed “Windows Utility Suite” that delivers GodRAT
A 62 MB EV-signed .NET app hides a 9.7 KB loader that downloads a gh0st RAT module over plain TCP and injects it into a hidden cmd.exe. The…
A signed “IEProc.exe” that delivers the APT-Q-27 backdoor in three stages
An EV-signed .NET downloader hides its logic in a virtual machine, pulls a kit from Google Cloud Storage, and sideloads APT-Q-27's Golden Gh0st RAT backdoor through a genuine…
A signed “touch controller” that only talks to servers with the right ID badge
QuaTouchCtrl.exe poses as an EV-signed touch-controller utility, but it is a small stager that checks in with an attacker server over mutual TLS and runs whatever programs it…
CloakGuard: a signed “remote management” agent that fakes a blue screen while someone uses your PC
A code-signed Go agent calling itself CloakGuard hides as SgrmBroker.exe, makes itself unkillable, can disable Defender, and paints a fake blue screen the operator can see straight through.…
About
Rogue Authority LLC — cybersecurity consulting and open-source tooling for the security community.
View Projects