Threat Actors Using an Armed OpenBullet Pentesting Tool to Manipulate Script Kids

Recent reports indicate that threat actors have been manipulating Script kiddies or amateur hackers into performing malicious actions that they never intended. This is done with the OpenBullet tool, which is used by web application testers and security professionals.

OpenBullet is an open-source security testing tool that can be used for conducting simple repetitive tasks as well as complex attacks with the help of a configuration file.

These configuration files are designed by sophisticated hackers and traded, shared, or even sold to cybercriminals.

However, these configuration files can be a single line or even hundreds of lines of code. Highly complicated codes are hard for initial-level hackers to read and understand.

Such a configuration file was found on a Telegram channel which seemed to have been maliciously coded for credential stuffing and account takeover attacks.

Weaponized OpenBullet Pentesting Tool

Further analyzing the configuration file, it was revealed that the code was designed to bypass Google’s reCAPTCHA and had multiple functions inside it along with a COOKIE variable.

It was found that the configuration file does more than just bypass the CAPTCHA.

COOKIE variable before concatenation (Source: Kasada)

The function written on the configuration file concatenates the COOKIE variable, which forms a Pastebin URL that redirects to a GitHub URL that consists of a repository called GetChromeUpdates.

OpenBullet retrieves the binary hosted on this repository which was found in a chromedriver.exe file.

This chromedriver.exe file replaces the SeleniumWebDriver used in OpenBullet. Once it is done, OpenBullet creates a new session that downloads two payloads from the same GitHub repository as Ocean and Patent.

Workflow of OpenBullet Telegram RAT

Ocean is the downloaded script while Patent is a Python-based executable that does not have any obfuscation during compiling and was written in Python version 3.11.

Furthermore, the scripts download malware from the repository called Telegram-RAT, which contains the malware written in Python. It communicates with the command and control server using telebot.

A complete report has been published by the Kasada Threat Intelligence team which provides complete information on the methods, mechanisms, and code used by the threat actors.

Keep informed about the latest Cyber Security News by following us on GoogleNews, Linkedin, Twitter, and Facebook.

Eswar

Eswar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Recent Posts

CISA Issues 9 New ICS Advisories Addressing Critical Vulnerabilities

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released nine new advisories detailing severe…

25 minutes ago

10 Best Email Security Solutions in 2025

Email security solutions are critical for protecting organizations from the growing sophistication of cyber threats…

1 hour ago

WhatsApp Job Offer Scam Targets Job Seekers in New Phishing Attack

A new form of phishing attack is making waves among job seekers, as cybercriminals exploit…

1 hour ago

SOC Alert Fatigue Hits Peak Levels As Teams Battle Notification Overload

Security Operations Centers (SOCs) are facing a mounting crisis: alert fatigue. As cyber threats multiply…

2 hours ago

Chinese UNC5174 Group Expands Arsenal with New Open Source Tool and C2 Infrastructure

The Sysdig Threat Research Team (TRT) has revealed a significant evolution in the offensive capabilities…

2 hours ago

“Living-off-the-Land Techniques” How Malware Families Evade Detection

Living-off-the-Land (LOTL) attacks have become a cornerstone of modern cyber threats, allowing malware to evade…

2 hours ago