Hiding kernel-driver for x86/x64.

windows rootkit driver hacktoberfest anti-debugging

• Updated Jul 18, 2026
• C

Windows rootkit for Intel x64 with 25+ features, demonstrating rootkit techniques compatible with all Windows 10 and Windows 11 versions.

windows kernel cpp rootkit driver cybersecurity infosec cyber-security red-team rootkits redteam windows-rootkits rootkit-kernel

• Updated Sep 26, 2026
• C++

LKM rootkit for Linux Kernels 2.6.x-7.x (x86/x86_64 and ARM/ARM64)

c linux security security-audit kernel backdoor kernel-module rootkit malware linux-kernel hacking pentesting pentest stealth hacking-tool security-tools redteaming lkm-rootkit redteam advanced-persistent-threat

• Updated Nov 3, 2026
• C

Fileless ring 3 rootkit with installer and persistence that hides processes, files, network connections, etc.

rootkit av-evasion fileless

• Updated Nov 3, 2026
• C

awesome-linux-rootkits

linux awesome rootkit linux-kernel awesome-list lkm-rootkit

• Updated Feb 15, 2026

windows kernel security development

framework rootkit driver antivirus shellcode bootkit antirootkit

• Updated Sep 6, 2022

Windows driver with usermode interface which can hide processes, file-system and registry objects, protect processes and etc

windows security registry kernel rootkit driver rce malware-analysis

• Updated Jul 13, 2022
• C

Webshell && Backdoor Collection

shell backdoor rootkit webshell

• Updated Apr 6, 2020
• PHP

A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.

security kernel backdoor rootkit ebpf libbpf

• Updated Apr 7, 2024
• C

Stealthy Linux Kernel Rootkit

linux kernel rootkit poc lkm syscall hidden hooking ftrace

• Updated Nov 6, 2026
• C

Stealthy, Linux-first multi-operator C2 with a self-healing mesh, in-memory execution, and an AI-driven MCP assistant.

windows linux rootkit malware active-directory rat post-exploitation stealth hacking-tool c2 penetration-testing-framework redteaming redteam trojan-malware emp3r0r

• Updated Nov 12, 2026
• Go

This is the list of all rootkits found so far on github and other sites.

rootkit rootkits redteam offensive-scripts

• Updated Aug 29, 2025

Now You See Me, Now You Don't

windows kernel rootkit driver malware-research malware-development

• Updated May 22, 2026
• C++

Linux LD_PRELOAD rootkit (x86 and x86_64 architectures)

c linux cli library debian rootkit ldpreload dynamic linker userland preload tui libc reboot libpcap libdl libpam libssl shared

• Updated Dec 11, 2020
• C

Cronos is Windows 10/11 x64 ring 0 rootkit. Cronos is able to hide processes, protect and elevate them with token manipulation.

kernel rootkit x64 windows-10 ring0 windows-11 windows-rootkits

• Updated Mar 29, 2022
• C++

PCI Express DIY hacking toolkit for Xilinx SP605. This repository is also home of Hyper-V Backdoor and Boot Backdoor, check readme for links and info

kernel fpga backdoor rootkit hypervisor uefi xilinx hyper-v dma microblaze pci-e

• Updated Mar 7, 2026
• C

ebpfkit is a rootkit powered by eBPF

linux security kernel rootkit linux-kernel ebpf linux-kernel-hacking runtime-security

• Updated Feb 28, 2023
• C

Linux rootkit for Ubuntu 16.04 and 10.04 (Linux Kernels 4.4.0 and 2.6.32), both i386 and amd64

kernel-module rootkit linux-kernel-module linux-rootkit

• Updated Apr 7, 2024
• C

？什么你说Root？我不到啊 | 致力于编写全面详细的Root教程文档 | 刷机 | 安卓

android rootkit root magisk

• Updated Jul 29, 2024

This tool will setting up your backdoor/rootkits when backdoor already setup it will be hidden your spesisifc process,unlimited your session in metasploit and transparent. Even when it killed, it will re-run again. There always be a procces which while run another process,So we can assume that this procces is unstopable like a Ghost in The Shell

linux backdoor rootkit infinite-scroll postgresql ghost indonesia inject post-exploitation msfvenom unlimited metasploit

• Updated Sep 1, 2022
• Shell