Wednesday, May 14, 2025
HomeCyber Security NewsThreat Actors Using an Armed OpenBullet Pentesting Tool to Manipulate Script Kids

Threat Actors Using an Armed OpenBullet Pentesting Tool to Manipulate Script Kids

Published on

SIEM as a Service

Follow Us on Google News

Recent reports indicate that threat actors have been manipulating Script kiddies or amateur hackers into performing malicious actions that they never intended. This is done with the OpenBullet tool, which is used by web application testers and security professionals.

OpenBullet is an open-source security testing tool that can be used for conducting simple repetitive tasks as well as complex attacks with the help of a configuration file.

These configuration files are designed by sophisticated hackers and traded, shared, or even sold to cybercriminals.

- Advertisement - Google News

However, these configuration files can be a single line or even hundreds of lines of code. Highly complicated codes are hard for initial-level hackers to read and understand.

Such a configuration file was found on a Telegram channel which seemed to have been maliciously coded for credential stuffing and account takeover attacks.

Weaponized OpenBullet Pentesting Tool

Further analyzing the configuration file, it was revealed that the code was designed to bypass Google’s reCAPTCHA and had multiple functions inside it along with a COOKIE variable.

It was found that the configuration file does more than just bypass the CAPTCHA.

COOKIE variable before concatenation (Source: Kasada)

The function written on the configuration file concatenates the COOKIE variable, which forms a Pastebin URL that redirects to a GitHub URL that consists of a repository called GetChromeUpdates.

OpenBullet retrieves the binary hosted on this repository which was found in a chromedriver.exe file.

This chromedriver.exe file replaces the SeleniumWebDriver used in OpenBullet. Once it is done, OpenBullet creates a new session that downloads two payloads from the same GitHub repository as Ocean and Patent.

Workflow of OpenBullet Telegram RAT

Ocean is the downloaded script while Patent is a Python-based executable that does not have any obfuscation during compiling and was written in Python version 3.11.

Furthermore, the scripts download malware from the repository called Telegram-RAT, which contains the malware written in Python. It communicates with the command and control server using telebot.

A complete report has been published by the Kasada Threat Intelligence team which provides complete information on the methods, mechanisms, and code used by the threat actors.

Keep informed about the latest Cyber Security News by following us on GoogleNews, Linkedin, Twitter, and Facebook.

Eswar
Eswar
Eswar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Latest articles

Microsoft Patch Tuesday May 2025 Released With the Fixes for 72 Flaws With 5 Actively Exploited 0-Day

Microsoft has released its May 2025 Patch Tuesday updates, addressing 72 security vulnerabilities across...

Ivanti Released Security Updates to Fix for the Mutiple RCE Vulnerabilities – Patch Now

Ivanti, a leading enterprise software provider, has released critical security updates addressing vulnerabilities across...

Fortinet FortiVoice Zero-day Vulnerability Actively Exploited in The Wild

A critical stack-based buffer overflow vulnerability (CWE-121) has been discovered in multiple Fortinet products,...

Ransomware Attacks Surge by 123% Amid Evolving Tactics and Strategies

The 2025 Third-Party Breach Report from Black Kite highlights a staggering 123% surge in...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Microsoft Patch Tuesday May 2025 Released With the Fixes for 72 Flaws With 5 Actively Exploited 0-Day

Microsoft has released its May 2025 Patch Tuesday updates, addressing 72 security vulnerabilities across...

Ivanti Released Security Updates to Fix for the Mutiple RCE Vulnerabilities – Patch Now

Ivanti, a leading enterprise software provider, has released critical security updates addressing vulnerabilities across...

Fortinet FortiVoice Zero-day Vulnerability Actively Exploited in The Wild

A critical stack-based buffer overflow vulnerability (CWE-121) has been discovered in multiple Fortinet products,...