Browse public community intelligence reports, source analysis, and threat research.
269 intel reports
The CL-CRI-1089 threat actor is conducting malvertising campaigns targeting macOS users to deploy FlutterShell, a Flutter-based backdoor that facilitates browser hijacking and arbitrary command execution.
The Iran-nexus group Screening Serpens is targeting technology, aerospace, and defense professionals in the US, Israel, and UAE using advanced AppDomainManager hijacking and new RAT variants.
The TeamPCP threat group is conducting a large-scale supply chain campaign using the 'Mini Shai-Hulud' worm to compromise npm packages, steal CI/CD and cloud credentials, and autonomously propagate.
JS.MonoGlyphRAT is a persistent JScript backdoor targeting US technology, MSSP, and telecom sectors using monoglyph-obfuscated scripts and encrypted PowerShell stagers.
The threat actor UAC-0184 is targeting Ukrainian Defense Forces using gated HTA delivery methods and complex DLL sideloading chains that culminate in the repurposing of legitimate, signed network utilities.
Financially motivated actors are using SEO poisoning to impersonate AI tools like Gemini and Claude Code, delivering a fileless PowerShell infostealer to developer workstations.
The Mini Shai-Hulud worm was deployed via compromised @antv npm packages to exfiltrate developer secrets and propagate to other repositories.
TamperedChef clusters leverage trojanized productivity software distributed via malvertising to deliver infostealers, RATs, and browser hijackers.
Chinese-speaking threat actor lwxat operates a Malware-as-a-Service (MaaS) ecosystem centered on BadIIS, targeting web servers for SEO fraud and malicious redirection.
CountLoader uses multi-stage PowerShell and JavaScript execution via mshta.exe to deploy a cryptocurrency clipper that redirects transactions by hijacking clipboard data.
