Stars and mentions
Last 30 days, Oct 4 – Nov 2
Package downloads
Top repositories
specterops’s repositories ranked by new stars, as on trending.
Contributes to
Repositories outside specterops’s account where specterops opened or reviewed pull requests in the past 365 days.
Who noticed specterops
Everyone who starred or forked specterops’s repositories since the archive began in 2011.
Notable accounts
Ordered by the stars their own repositories have received.
Biggest fans
Accounts that starred the most of these repositories.
Breakout weeks
Each repository’s best week of new stars, with the release published around it.
- Gold
- 01st place finishes
- Silver
- 02nd place finishes
- Bronze
- 03rd place finishes
- Awarded repositories
- 0Owned by specterops now
No trending awards yet
None of the repositories specterops owns has finished in the top three of a completed trending day or week, by stars, forks or PR authors. See who is trending now.
A repository earns an award for finishing first, second or third in a completed trending day or week, ranked by new stars, new forks or pull request authors. Awards follow a repository through renames and transfers and count toward its current owner. Weeks run Monday to Sunday, UTC.
Mentions
A collection of tools and resources related to the Pass-the-Passkey family of attacks, which target WebAuthn and FIDO2 authentication mechanisms in Windows
ConnectWise Cloud Backup (formerly SkyKick) Incident On October 16, 2026, at 21:22 UTC, SpecterOps security researchers learned of a widespread security incident involving ConnectWise Cloud Backup (formerly SkyKick) from a public Huntress post. Huntress confirmed that an unknown threat actor abused access obtained through SkyKick to reach customers’ Microsoft 365 environments, and reported more than 100 compromised tenants at the time of its post. We want to make sure that you are aware of this ongoing campaign so that you can take appropriate action. The SpecterOps team recommends the following actions: 1. Immediately disable application 506e08f9-6e9a-4da4-942b-a099a03644ae in the Entra admin center. 2. Download AzureHound (if you have not already done so) and run the collector. 3. Ingest the data in BloodHound 4. Run the queries below 5. Review your sign-in logs for service principal authentication tied to the application IDs listed above. Pay special attention to activity from the source IP 144.172.64[.]128. 6. Revoke unneeded application consents. If you don’t actively use SkyKick or ConnectWise Cloud Backup, remove their application consents from your tenant. Related BloodHound Cypher Queries Identify outbound control of ConnectWise application MATCH p=(sp:AZServicePrincipal)-[r]->(target) WHERE toLower(sp.appownerorganizationid) = ‘3f9cd7a0-127a-4ed4-bf06-2f830d5616b7’ RETURN p Identify outbound control of ConnectWise application MATCH p=(sp:AZServicePrincipal)-[r]->(target) WHERE toLower(sp.appownerorganizationid) = ‘3f9cd7a0-127a-4ed4-bf06-2f830d5616b7’ RETURN p Identify paths from the impacted service principal to Tier Zero. MATCH p=shortestPath((sp:AZServicePrincipal)-[*1..6]->(t)) WHERE toLower(sp.appownerorganizationid) = ‘3f9cd7a0-127a-4ed4-bf06-2f830d5616b7’ AND t.system_tags CONTAINS ‘admin_tier_0’ Identify paths from the impacted service principal to Tier Zero. MATCH p=shortestPath((sp:AZServicePrincipal)-[*1..6]->(t)) WHERE toLower(sp.appownerorganizationid) = ‘3f9cd7a0-127a-4ed4-bf06-2f830d5616b7’ AND t.system_tags CONTAINS ‘admin_tier_0’
github.com/specterops