Topics / #malware

Malware projects on GitHub

Malware samples, analysis and blocklists for malicious domains.

As of October 20, 2026, the most-starred Malware projects on GitHub are hosts (31.3K stars), dns-blocklists (27.6K stars) and Sandboxie (19.7K stars). GitHub.Locker tracks 31 Malware repositories with 285.2K stars combined. The fastest-growing on October 18 was dns-blocklists, with +50 stars in a day.

31Projects

285.2KStars in total

+248Stars in a day

Browse in the catalog →github.com/topics/malware ↗

Hot right now

Most stars gained in a day · Oct 18

+50

dns-blocklists

hagezi/dns-blocklists · ★ 27.6K

A set of DNS blocklists that block ads, trackers, telemetry, phishing, malware, scams and other junk domains network-wide. They work for any region and with every common DNS server, ad blocker, and content blocker.

+45

Cybersecurity-Projects

CarterPerez-dev/Cybersecurity-Projects · ★ 8.3K

This is a growing collection of 70 hands-on cybersecurity projects with full source code, organized into four difficulty tiers, plus 10 certification roadmaps and curated learning resources for cybersecurity careers.

+38

Reverse-Engineering

mytechnotalent/Reverse-Engineering · ★ 14.9K

A free, massive collection of reverse engineering and hacking tutorials covering x86, x64, ARM (32/64-bit), AVR, RISC-V, Windows internals, malware analysis, embedded systems, Rust, Go, Wasm, and more, delivered as free ebooks/lessons.

+22

reverse-engineering

wtsxDev/reverse-engineering · ★ 10.7K

A curated list of reverse engineering resources: books, courses, practice grounds, and a big toolbox section spanning hex editors, disassemblers, debuggers, and dynamic analysis tools.

The all-time top

31 projects · by stars

#1 · StevenBlack/hosts
hosts
A community-maintained aggregator that merges many reputable hosts files into one unified blocklist with duplicates removed — the base variant combines adware and malware lists and holds 80,169 entries.
31.3K
#2 · hagezi/dns-blocklists
dns-blocklists
A set of DNS blocklists that block ads, trackers, telemetry, phishing, malware, scams and other junk domains network-wide. They work for any region and with every common DNS server, ad blocker, and content blocker.
27.6K
#3 · sandboxie-plus/Sandboxie
Sandboxie
Sandboxie is a sandbox-based isolation tool for Windows that lets you run or install untrusted programs in an isolated virtual environment without permanently modifying your drives or registry.
19.7K

4
Awesome-Hacking-Resources
17.5Kvitalysim/Awesome-Hacking-Resources
A curated collection of hacking, penetration testing and AI red-teaming resources — courses, YouTube channels, CTF platforms and guides, picked to make you better at offensive security.
- kali-linux
- exploit-development
- privilege-escalation
- owasp
5
bytecode-viewer
15.7KKonloch/bytecode-viewer · Java
Bytecode Viewer (BCV) is a lightweight Java/Android reverse engineering suite: drag in a Jar or APK and it decompiles, disassembles, searches and debugs it, powered by several open source tools.
- bytecode
- debugger
- decompiler
- apk
6
wifiphisher
14.9Kwifiphisher/wifiphisher · Python
Wifiphisher is a rogue access point framework for conducting Wi-Fi phishing and man-in-the-middle attacks against wireless clients, used in red team and penetration testing engagements.
- redteaming
- phishing
- wifi-security
- wifi
7
Reverse-Engineering
14.9Kmytechnotalent/Reverse-Engineering · Assembly
A free, massive collection of reverse engineering and hacking tutorials covering x86, x64, ARM (32/64-bit), AVR, RISC-V, Windows internals, malware analysis, embedded systems, Rust, Go, Wasm, and more, delivered as free ebooks/lessons.
- assembly-language
- x64
- risc-v
- assembly
8
opensnitch
14.2Kevilsocket/opensnitch · Python
OpenSnitch is an interactive application firewall for GNU/Linux, inspired by macOS's 'Little Snitch', that lets you see and approve or block each app's outgoing connections in real time.
- ebpf
- linux-app
- firewall
- network-security
9
portmaster
14Ksafing/portmaster · Go
Portmaster is a free, open-source application firewall for Windows and Linux that intercepts all network traffic on your machine, letting you monitor and block connections per app, filter DNS, and block trackers and malware with good defaults out of the box.
- dns-over-tls
- dns-over-https
- tor
- ebpf
10
theZoo
13.5Kytisf/theZoo · Python
theZoo is a public repository of live malware samples and their source code, gathered so that anyone interested in malware analysis can study real specimens in an organized and accessible way.
- malware-analysis
- infosec
- virtualization
- collection
11
TheFatRat
11.5Kscreetsec/TheFatRat · C
TheFatRat is an exploiting tool that compiles malware from famous payloads — an easy way to generate backdoors built to slip past most anti-virus software.
- post-exploitation
- kali-linux
- remote
- bypass
12
Sn1per
11.5K1N3/Sn1per · Shell
Sn1per is an offensive-security platform that bundles reconnaissance, vulnerability scanning, exploitation and reporting into one workspace, orchestrating 600+ exploits and 90+ third-party tools for pentesters and attack-surface-management teams.
- osint-framework
- pentest-tool
- pentesting-tools
- osint-tool
13
Red-Teaming-Toolkit
10.8Kinfosecn1nja/Red-Teaming-Toolkit
It is a curated list of cutting-edge open-source security tools for red teamers and threat hunters, covering the full attack lifecycle from reconnaissance to exfiltration.
- command-and-control
- phishing
- credentials
- privilege-escalation
14
awesome-threat-intelligence
10.7Khslatman/awesome-threat-intelligence
A curated catalog of threat intelligence resources — feeds, tools, frameworks, standards and research for tracking online threats. It is a pointer list on GitHub, not software you install.
- threat-hunting
- blocklist
- threat-intelligence
- security-research
15
reverse-engineering
10.7KwtsxDev/reverse-engineering
A curated list of reverse engineering resources: books, courses, practice grounds, and a big toolbox section spanning hex editors, disassemblers, debuggers, and dynamic analysis tools.
- disassembler
- forensics
- malware-analysis
- decompiler
16
awesome-honeypots
10.6Kparalax/awesome-honeypots · Python
A curated, categorized list of honeypot software and related tools used by security researchers to deceive attackers, log their behavior, and study exploitation attempts.
- incident-response
- threat-intelligence
- forensics
- awesome-lists
17
nishang
10.2Ksamratashok/nishang · PowerShell
Nishang is a framework and large collection of PowerShell scripts and payloads for offensive security, penetration testing, and red teaming, covering every phase of an engagement.
- redteam
- infosec
- exploit
- powershell
18
Cybersecurity-Projects
8.3KCarterPerez-dev/Cybersecurity-Projects · Go
This is a growing collection of 70 hands-on cybersecurity projects with full source code, organized into four difficulty tiers, plus 10 certification roadmaps and curated learning resources for cybersecurity careers.
- certification
- red-team
- agplv3
- pentesting
19
Claude-Red
7.6KSnailSploit/Claude-Red · Python
claude-red is a curated library of offensive security skills for the Claude Skills system: structured SKILL.md files that prime Claude with expert-level methodology for one attack surface each, from SQLi to shellcode.
- vulnerability-research
- phishing
- post-exploitation
- pentesting-tools
20
fresh-start
6.2Knirholas/fresh-start
This is the repository formerly known as nirholas/claude-code, the most widely forked mirror of the Claude Code source leak from 31 March 2026. The leaked source itself was stripped out after Anthropic's DMCA notice, which has not been retracted, so the repo now just explains what happened.
- llms-txt
- fake
- supply-chain-security
- threat-intelligence
21
blocklist-abuseipdb
600borestad/blocklist-abuseipdb · Shell
A continuously updated set of IP blocklists aggregating AbuseIPDB's worst IPv4 and IPv6 offenders (~99% confidence), plus other free public threat sources, meant to be loaded straight into a firewall to block malicious traffic.
- blocklist
- ipv4
- ipv6
- threat-intelligence
22
Stuxnet
589Sadpainy/Stuxnet · C
This is a reconstructed source code of Stuxnet, the famous 2010 worm that sabotaged Siemens industrial control systems, rebuilt by the author from reverse-engineering research for educational and malware-analysis purposes.
- threat-intelligence
- forensics
- malware-analysis
- driver
23
umium
441hotline1337/umium · C++
Umium is a security-focused anti-debugging and anti-reverse-engineering library for high-resilience Windows 10/11 x64 applications. It uses undocumented Windows NT system functions and runtime modifications to detect and neutralize debugging, memory tampering, or sandboxing attempts.
- obfuscation
- header-only
- x86-64
- windows-10
24
vmp-lazy-unpack
407x86rc/vmp-lazy-unpack · Python
This is a Python tool that automatically unpacks Windows x64 binaries protected with VMProtect 3.x and rebuilds their import table (IAT), without needing a debugger or live memory dump.
- x86-64
- malware-analysis
- security-research
- binary-analysis
25
allinonetools
396LinkMouseIndex/allinonetools
A PowerShell tool that claims to give free, instant access to Steam's full game library (50,000+ titles) through a shared-account auto-login system, launched by pasting a single command into an admin terminal.
- crack
- cracking
- games
- piracy
26
Power-Director
252OverlordPrize/Power-Director
This repository distributes a pre-activated standalone installer for CyberLink PowerDirector 14.5, a commercial professional video-editing program, bundled with a PowerShell setup script instead of the real installer.
- windows-script
- cmd
- activation-tools
- fake
27
Wise-Care
252ScorpionPlan/Wise-Care
This repo distributes a 'pre-activated standalone' installer for Wise Care, a Windows PC optimization and maintenance tool, claiming to bypass its normal registration and evaluation limits.
- cleanup
- activation-tools
- fake
- cleaner
28
Hwid-Spoofer
252southroadball/Hwid-Spoofer
This is a 'Hwid Spoofer Free' standalone Windows installer that claims to change your disk serial number and MAC address to fake a different hardware identity, bundled with a PatchGuard bypass and a driver signature enforcement (DSE) bypass.
- cheat
- crack
- powershell
- hacking-tool
29
Uttorent
250RiggerVitalize/Uttorent
A pre-activated standalone Windows installer package for 'Uttorent' (a uTorrent-style torrent client), version 1.4, bundled to run offline without any registration or activation steps.
- windows-script
- activation-tools
- fake
- crack
30
Discord-Server-Cloner
250StoneSniperStrip/Discord-Server-Cloner
It claims to be a Windows desktop installer that clones Discord servers, distributed as a 'pre-activated standalone build' rather than source code.
- activation-tools
- fake
- crack
- cracking
31
mythos-5-incident-transcript
129anthropics/mythos-5-incident-transcript · HTML
A raw transcript Anthropic released of its Mythos 5 model (Claude) working through a cybersecurity evaluation — its full thinking and tool calls, published because the run shows concerning behavior.
- transcript
- incident-response
- llm-security
- ai-safety