GlassWorm VS Code Extension Scanner - Detect & Remove Malicious Extensions
Cross-platform scanner to detect and remove GlassWorm malware from VS Code extensions. Detects 14 known infected extensions, invisible Unicode code, Solana blockchain C2, credential theft patterns, and system compromise. Auto-removes infected extensions with --remove flag. Works on Windows, macOS, and Linux.
#!/usr/bin/env python3
"""
GlassWorm VS Code Extension Scanner
Detects and removes malicious VS Code extensions infected by the GlassWorm worm
Based on Koi Security research (October 2025)
"""Chrome Extension Scanner for WhatsApp Spamware (131+ Malicious Extensions)
Python scanner to detect 131+ compromised Chrome extensions targeting WhatsApp Web users. Identifies malicious extensions from the October 2025 spamware campaign (Socket.dev research) that inject code into WhatsApp to automate bulk messaging. Scans installed extensions, calculates risk scores, and generates detailed reports. Detects known malicious publishers (WL Extensão), suspicious permissions, and code injection patterns.
#!/usr/bin/env python3
"""
Chrome Extension Analyzer for WhatsApp Spamware Campaign
Detects the 131 compromised extensions targeting WhatsApp Web users
Based on Socket.dev research (October 2025)
"""Check Your WordPress Site for CVE-2025-5947 Authentication Bypass
Free security check script for WordPress sites using the Service Finder theme. Detects CVE-2025-5947 authentication bypass vulnerability (CVSS 9.8 Critical) that allows attackers to gain administrator access. This script checks your theme version, scans for exploitation attempts in server logs, and provides actionable security recommendations. Includes .htaccess mitigation rules for temporary protection while you update to version 6.1+.
<?php
/**
* CVE-2025-5947 Security Check Script
* Checks for Service Finder Bookings authentication bypass vulnerability
*
* USAGE: Place this file in your WordPress root directory and access via browserDetection Script for BatShadow/Vampire Bot
PowerShell script for detecting and remediating BatShadow threat actor's Vampire Bot malware. Based on threat intelligence from Aryaka Threat Research Labs (October 2025). Scans for malicious files, suspicious processes, C2 connections, registry persistence, and provides automated remediation capabilities.
#Requires -RunAsAdministrator
<#
.SYNOPSIS
Detection and remediation script for BatShadow/Vampire Bot malware
Scanning for SORVEPOTEL
PowerShell script to detect indicators of SORVEPOTEL malware on Windows systems. Scans for suspicious ZIP extractions in temp directories, active WhatsApp Web processes, recent PowerShell execution logs, and newly created scheduled tasks. Designed to identify systems potentially compromised by the self-propagating WhatsApp-based malware targeting enterprise environments in late 2024.
# Check for suspicious ZIP extractions in temp directories
Get-ChildItem -Path $env:TEMP -Recurse -Filter "*.exe" -ErrorAction SilentlyContinue |
Where-Object {$_.CreationTime -gt (Get-Date).AddDays(-7)}
# Check for WhatsApp Web active processes
Get-Process | Where-Object {$_.ProcessName -like "*whatsapp*"}Quick Close Vulnerable Ports
Quickly close windows 11 vulnerable ports. Save file as .bat and run. *Use at own risk
@echo off
setlocal
set "GROUP=QuickClose_VulnPorts"
:: Must run as Administrator
net session >nul 2>&1 || (echo [!] Run this as Administrator.& pause & exit /b 1)