The Accidental Malware Repository: Hunting & Collecting Malware Via Open Directories (Part 1)

Using open directories, Hunt.io shows how XWorm RAT samples masquerade as browsers, security tools and file-transfer apps—including a lone SecurityHealthService.exe on a Thai-hosted server.

An obfuscated JavaScript downloader abusing paste.ee to stage payloads leads researchers to XWorm and AsyncRAT C2 infrastructure, with regex and SSL detection guidance for defenders.

Two case studies of malware delivered via open directories: an AsyncRAT chain using VBScript and BITS to fetch a staged payload, and a Fernet-wrapped Python executable beside a SuperShell login page.

Part 1 of the Cobalt Strike series: using AttackCapture to mine open directories for PowerShell loaders and configs, then pivoting via SSL certificates and fingerprints to map live C2 servers.

Tracing TinyLoader from one Latvian IP: it spreads via USB and fake shortcuts, swaps crypto wallet addresses via clipboard, and installs Redline Stealer and DCRat from panels across Europe.

A case study in proactively hunting ClickFix delivery pages: custom HuntSQL queries surface live, previously unreported malicious domains behind the Windows Run-dialog clipboard trick.