From 4cca6d0f28b2e21ed1b90e376f7d4282112f9e7f Mon Sep 17 00:00:00 2001 From: Bobby Cooke <19784872+boku7@users.noreply.github.com> Date: Fri, 11 Apr 2025 07:34:38 -0700 Subject: [PATCH] Update README.md --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index adc6521..cab80f4 100644 --- a/README.md +++ b/README.md @@ -2,8 +2,8 @@ Loki is a stage-1 command and control (C2) framework written in Node.js, built to script-jack vulnerable Electron apps _[MITRE ATT&CK T1218.015](https://attack.mitre.org/techniques/T1218/015/)_. Developed for red team operations, Loki enables evasion of security software and bypasses application controls by exploiting trusted, signed Electron apps. Script-jacking is the act of hijacking the execution flow of an Electron app by modifying JavaScript files loaded at runtime with arbitrary Node.js code. This technique can be leveraged to: -- Backdoor the Electron app -- Hollow out the Electron app +- __Backdoor the Electron app__ +- __Hollow out the Electron app__ - Chain execution to another process While several tools already address leveraging script-jacking to chain execution to another process, Loki is the first to enable backdooring and hollowing of signed Electron apps without invalidating their code signing signature.