A newly uncovered Telegram-controlled attack framework, dubbed NULLZEREPTOOL, combines a functional DDoS engine with code for WiFi password extraction, wireless disruption, proxy rotation, and botnet tasking.
Researchers found the Python source in a Pastebin post flagged on April 29, 2026, then identified an earlier version sharing the same hardcoded Telegram bot token, administrator ID, and password linking both samples to one evolving codebase.
The framework demonstrates how low-tier malware-as-a-service tools can expand from simple denial-of-service capabilities into broader credential theft and endpoint-control functions.
However, researchers stressed that several newer modules are present only in server-side source code; no corresponding client binary was found, so their end-to-end use remains unconfirmed.
WiFi Credential Theft Framework
NULLZEREPTOOL uses Telegram as its command-and-control interface, with authenticated commands for launching attacks, updating proxy lists, creating access keys, and viewing attack statistics.
Its DDoS component contains 20 attack methods, dedicated worker threads, automatic scaling, a website watchdog, and a proxy-validation pipeline.
The most capable routine, known as combo_worker, repeatedly issues HTTP GET, POST, HEAD, and OPTIONS requests with randomized headers and query strings.
It also sends UDP traffic and initiates short-lived TCP connections against the selected target, combining application- and network-layer flooding in a single operation.
The code can begin with up to 1,000 worker threads and scale to 2,000 when measured request rates drop below 70% of the operator’s chosen target.
A watchdog checks the target every five seconds and stops the flood when it considers the website unreachable.
The framework also gathers public proxies from multiple online sources, validates them, and saves responsive entries to a local proxy.txt file.
During attacks, it rotates proxies and removes failed entries from its active pool. This behavior can make simple IP-based blocking less effective.
Researchers observed attack attempts against several websites, including Shopmuabancf[.]com, Bloomberg[.]com, and gaming-related domains.
The observed results varied widely, reinforcing that actual performance depends on proxy quality, local bandwidth, target protections, and the attacker’s runtime environment.
| Category | NULLZEREPTOOL Capability | Technical Details | Assessment |
|---|---|---|---|
| Discovery | Pastebin-hosted Python source | Flare flagged the source-code post on April 29, 2026 | Two related variants identified |
| Command and Control | Telegram bot control | Hardcoded bot token, admin ID, password, and session tracking | Implemented |
The later NULLZEREPTOOL variant adds commands intended to collect saved WiFi passwords from compromised systems.
On Windows, the code uses netsh wlan show profile … key=clear to retrieve stored wireless credentials. On Linux, it calls nmcli to query WiFi connection settings and extract pre-shared keys, flare said.
It also includes WiFi deauthentication and Bluetooth disruption functions. Linux routines invoke tools such as aireplay-ng, l2ping, and hcitool, meaning the attacks require compatible adapters, elevated privileges, and supporting utilities.
The WiFi cracking workflow references hcxdumptool, hcxpcapngtool, and Hashcat, indicating support for handshake capture, conversion, and dictionary-based cracking.
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
