C2 - Tag - b1n0x41https://0x41.me/tags/c2/C2 - Tag - b1n0x41Hugo -- gohugo.ioenFri, 01 Aug 2025 00:00:00 +0000The Trusted Traphttps://0x41.me/2025/08/thetrustedtrap/Fri, 01 Aug 2025 00:00:00 +0000xxxxhttps://0x41.me/2025/08/thetrustedtrap/

While digging into a GitHub CVE proof-of-concept, I found something no one expects: a live malware implant hiding inside a github repo files. Specifically, a Visual Studio .suo file. the kind we all ignore. was secretly delivering and executing payloads using a sophisticated combination of XAML deserialization, base64 obfuscation, and registry persistence.

What Is the Trusted Trap?

Visual Studio .suo files are supposed to be harmless — they’re just project metadata, right? Wrong. They’re actually OLE compound files that can contain:

]]>