Browse public community intelligence reports, source analysis, and threat research.
68 intel reports
DirtyFrag is a sophisticated Linux kernel Local Privilege Escalation toolkit that uses page cache corruption and RxRPC/AF_ALG abuse to gain root access.
Threat actor SheldIO is deploying Amatera Stealer 4.0.2 via the EVALUSION campaign, featuring advanced evasion techniques and significantly expanded targeting for cryptocurrency wallets and messaging apps.
An unknown threat actor is exploiting a critical cPanel authentication bypass (CVE-2026-41940) to target South-East Asian military and government entities for data exfiltration and persistent network access.
A Qilin ransomware affiliate is targeting WatchGuard and Fortinet appliances using multiple CVEs to deploy Sliver C2 and establish reverse SOCKS tunnels into internal networks.
NVIDIA's NemoClaw sandbox environment is vulnerable to data exfiltration and configuration poisoning via weaponized authorized tools and emoji-based evasion.
Threat actor 0xFFF (aka alh1mik) has released notnullOSX, a modular Go-based macOS stealer and backdoor targeting high-value cryptocurrency users through ClickFix social engineering.
The FAUX#ELEVATE campaign uses heavily obfuscated VBScript lures targeting French corporate environments to deploy a multi-stage toolkit including XMRig miners and browser credential stealers.
Aura Stealer is a sophisticated C++ info-stealer utilizing five obfuscation layers and Heaven's Gate techniques to target Chromium browsers and crypto wallets.
