.. /NATApp
Star

Phishing

NATApp is a Chinese ngrok-based SaaS tunneling service that exposes a local port under a generated natappfree.cc (free tier) or custom domain. It is widely used in Chinese developer tutorials for exposing local web services and WeChat callback endpoints, and is a plausible exfiltration or C2 channel for hosts reachable from a Chinese network.

Paths:

config.ini (authtoken configuration file in the same directory as the binary)

Resources:

https://natapp.cn/

Detections:

Domain: *.natappfree.cc
Command: Execution of natapp with -authtoken, or launched with a config.ini containing an authtoken value.

Phishing

Starts the client using a tunnel authtoken obtained from the NATApp dashboard, exposing the configured local port under a natappfree.cc (free tier) or reserved domain.
```
natapp -authtoken=<AUTHTOKEN>
```
Use case
Exposing a local file system, web application, or phishing page over the internet.

Privileges required
User

Operating systems
Windows, Linux, MacOS

.. /NATApp Star

Paths:

Resources:

Detections:

Phishing

.. /NATApp
Star