If you see this in a config, DO NOT DOWNLOAD.

[211]

Any time you see this in a config, it is executing a stealer. I had this happen to me and when we sat there and looked at what it did, we came back to this:
https://github.com/w4sp-book/w4sp-lab

This is what it led back to.

It will look like this:


Or very similar.

I'm not even gonna lie, this is a genius way to do this, but once you run the config it (somehow) spreads to all your other configs. When you send them to anyone, the process starts again. As it is a stealer, it will steal your information. And this is one of the many reasons i suggest running configs on an RDP.

This is similar to the malicious API thing, but smarter as most people won't recognize it as anything.

[2.157]

Thank you for this information sir, HQ work

[211]

The crazy thing is these configs will still function perfectly, while fucking you hard.

[166]

This happened to me, I used a setting that downloaded an infected file to the "bin" folder after I managed to remove the virus, I found that the setting had infwctated all the other settings I had.

[211]

Example of this:
https://cracked.io/Thread-ANOM-ANOM-%E2%...-%E2%9A%A1

[918]

SUPER HQ INFO +

BUY MY DATING ACCOUNTS : TELEGRAM @ITSDREXZ

[30]

Any time you see this in a config, it is executing a stealer. I had this happen to me and when we sat there and looked at what it did, we came back to this:
https://github.com/w4sp-book/w4sp-lab

This is what it led back to.

It will look like this:


Or very similar.

I'm not even gonna lie, this is a genius way to do this, but once you run the config it (somehow) spreads to all your other configs. When you send them to anyone, the process starts again. As it is a stealer, it will steal your information. And this is one of the many reasons i suggest running configs on an RDP.

This is similar to the malicious API thing, but smarter as most people won't recognize it as anything.

there is another way to infect the person's computer, it makes a GET request and receives the source as an .exe file in the selenium folder and once the selenium block is launched it calls the downloaded file and infects the computer

[42]

Holy, what a find, possible to maybe get the malicous config finder tool updated to get it to remove this aswell?