Latest
Blog
A signed “PeaZip 11.4.0” MSI that installs a self-updating backdoor
A signed MSI posing as PeaZip 11.4.0 shows you the real installer while a fake msimg32.dll, sideloaded into genuine peazip.exe, sets up a scheduled task and waits to…
A signed “Microsoft Teams” installer that waits a minute, then plants a RAT
An EV-signed fake Microsoft Teams MSI side-loads through a genuine calibre.exe, waits 62 seconds, and unpacks the BabaDeda loader and the CNCMachineRMS remote access trojan.
A signed “PuTTY” installer that hides a malware loader inside Node.js
An EV-signed PuTTY.msi opens the real PuTTY while a re-signed, untouched Node.js runs a hidden script that waits five minutes, checks for EDR, and pulls an in-memory 'luna'…
A signed “WindowsDefender.msi” that hands attackers your command prompt
A validly signed MSI named after Microsoft Defender installs a tiny Rust remote shell ("c2_agent") that runs attacker commands through cmd.exe and PowerShell over AES-encrypted HTTPS.
CrocoRAT: a signed “Chrome installer” that brings its own Python
A validly signed ChromeInstaller.msi installs its own copy of Python and runs the CrocoRAT kit: a remote-access trojan, a fake "Windows Security" login prompt, a Chrome/Edge stealer and…
“SilentSetup”: a signed installer that waits for its start date, then drops the PackClient RAT
A signed, date-gated .NET installer downloads a zip, sideloads a malicious DLL next to an old printer program, and starts the PackClient RAT. The RAT then pushes a…
“Device locked, please wait”: a signed remote agent that hides its operator behind a fake lock screen
A signed "Werkstatt IT Management" agent, watchdog and MeshCentral agent share one personal certificate. On command it shows a "device locked, please wait" screen that the remote operator…
A “setup.iso” that runs Python from a text file, then steals your browser and hands over your PC
An 88 MB ISO runs a bundled IronPython on a disguised text file, unpacks five in-memory stages and a CastleLoader-like bot, then installs StealC v2 and the NetSupport…
A “Disk Manager” that installs someone else’s remote desktop
A signed "Disk Manager Service Installer" silently installs the commercial RdViewer remote-desktop tool as a SYSTEM service, relabelled and pre-wired to an operator relay, then deletes itself.
About
Rogue Authority LLC — cybersecurity consulting and open-source tooling for the security community.
View Projects