social-engineering PoCs
subscribe (RSS)Proof-of-concept research filed under the social-engineering category.
Entries
6
in social-engineering
CISA KEV
2
exploited in the wild
Ransomware
0
known campaign use
Unpatched
6
no vendor fix
Critical
0
0% of listed
Severity
Exploitation signals
Patch status
Date range
6 result(s)
- N/A social-engineering HIGH
ClickFix Social-Engineering Technique — Fortinet-Branded Multi-Stage Lure (Fake File-Access Page + Fake CAPTCHA + Clipboard Injection)
This entry documents a second ClickFix-style social-engineering demo, distinct from other ClickFix variants in this archive: a multi-stage lure that opens with a Fortinet-branded fake "Secure File Access" page (index.html) requesting a work email, then…
Unverified 2026-07-27 - N/A social-engineering HIGH
ClickFix Social Engineering Technique — Fake Cloudflare Turnstile Just a Moment Verification Lure
ClickFix is a widely reported in-the-wild social-engineering technique in which a fake CAPTCHA or "verification" page tricks a victim into copying an attacker-controlled command (silently injected into the clipboard by the page) and pasting/executing it…
Unverified 2026-07-27 - N/A social-engineering HIGH
ClickFix Fake-CAPTCHA Social-Engineering Kit with IP Fencing and 19-Language Localization
This is a fork of 0x204/ClickFix-Turnstile that adds two enhancements: real IP allow/block fencing at the Cloudflare Worker edge (checking the cf-connecting-ip request header against a hardcoded ALLOWEDIPS[] array before serving content), and genuine…
Unverified 2026-07-27 - N/A social-engineering HIGH
ClickFix Fake reCAPTCHA to mshta/HTA Execution Chain
This is a reference implementation of ClickFix, a widely used real-world social-engineering technique (reported by Unit42, Huntress, and Orange CyberDefense as used by numerous threat actors since roughly 2024, including in LummaStealer and Emmenhtal malware…
Unverified 2026-07-27 - CVE-2026-21510 social-engineering HIGH KEV EPSS 26%
Windows ShellLink (.lnk) Remote Code Execution — CVE-2026-21510 LNK-Stomping Generator
This is a standalone Python generator (lnkstomperpoint.py) that builds malicious Windows .lnk shortcut files exploiting CVE-2026-21510, a ShellLink remote-code-execution issue in how Windows resolves and launches shortcut targets. The tool assembles a…
Unverified 2026-07-05 - CVE-2026-21514, CVE-2026-21510 social-engineering HIGH KEV
RTF Protected-View Bypass (CVE-2026-21514) Chained with ShellLink RCE (CVE-2026-21510) — Builder Scripts
This repository contains two small builder scripts used to research a document-based attack chain: genrtf.py assembles a malicious RTF file containing an embedded OLE object whose payload is a hex-encoded UNC path (\\127.0.0.1@80\final.lnk) to a remotely…
Unverified 2026-07-05