Wednesday, May 7, 2025
HomeCyber Security NewsThreat Actors Using an Armed OpenBullet Pentesting Tool to Manipulate Script Kids

Threat Actors Using an Armed OpenBullet Pentesting Tool to Manipulate Script Kids

Published on

SIEM as a Service

Follow Us on Google News

Recent reports indicate that threat actors have been manipulating Script kiddies or amateur hackers into performing malicious actions that they never intended. This is done with the OpenBullet tool, which is used by web application testers and security professionals.

OpenBullet is an open-source security testing tool that can be used for conducting simple repetitive tasks as well as complex attacks with the help of a configuration file.

These configuration files are designed by sophisticated hackers and traded, shared, or even sold to cybercriminals.

- Advertisement - Google News

However, these configuration files can be a single line or even hundreds of lines of code. Highly complicated codes are hard for initial-level hackers to read and understand.

Such a configuration file was found on a Telegram channel which seemed to have been maliciously coded for credential stuffing and account takeover attacks.

Weaponized OpenBullet Pentesting Tool

Further analyzing the configuration file, it was revealed that the code was designed to bypass Google’s reCAPTCHA and had multiple functions inside it along with a COOKIE variable.

It was found that the configuration file does more than just bypass the CAPTCHA.

COOKIE variable before concatenation (Source: Kasada)

The function written on the configuration file concatenates the COOKIE variable, which forms a Pastebin URL that redirects to a GitHub URL that consists of a repository called GetChromeUpdates.

OpenBullet retrieves the binary hosted on this repository which was found in a chromedriver.exe file.

This chromedriver.exe file replaces the SeleniumWebDriver used in OpenBullet. Once it is done, OpenBullet creates a new session that downloads two payloads from the same GitHub repository as Ocean and Patent.

Workflow of OpenBullet Telegram RAT

Ocean is the downloaded script while Patent is a Python-based executable that does not have any obfuscation during compiling and was written in Python version 3.11.

Furthermore, the scripts download malware from the repository called Telegram-RAT, which contains the malware written in Python. It communicates with the command and control server using telebot.

A complete report has been published by the Kasada Threat Intelligence team which provides complete information on the methods, mechanisms, and code used by the threat actors.

Keep informed about the latest Cyber Security News by following us on GoogleNews, Linkedin, Twitter, and Facebook.

Eswar
Eswar
Eswar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Latest articles

Severe Kibana Flaw Allowed Attackers to Run Arbitrary Code

A newly disclosed security vulnerability in Elastic’s Kibana platform has put thousands of businesses...

IT Worker from Computacenter Let Girlfriend Into Deutsche Bank’s Restricted Areas

A former information technology manager has filed a whistleblower lawsuit alleging a major security...

NSO Group Ordered to Pay $168 Million to WhatsApp in US Spyware Verdict

A federal jury in California has ordered Israeli spyware maker NSO Group to pay...

BFDOOR Malware Targets Organizations to Establish Long-Term Persistence

The BPFDoor malware has emerged as a significant threat targeting domestic and international organizations,...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Severe Kibana Flaw Allowed Attackers to Run Arbitrary Code

A newly disclosed security vulnerability in Elastic’s Kibana platform has put thousands of businesses...

IT Worker from Computacenter Let Girlfriend Into Deutsche Bank’s Restricted Areas

A former information technology manager has filed a whistleblower lawsuit alleging a major security...

NSO Group Ordered to Pay $168 Million to WhatsApp in US Spyware Verdict

A federal jury in California has ordered Israeli spyware maker NSO Group to pay...