Browse public community intelligence reports, source analysis, and threat research.
269 intel reports
TeamPCP executed a supply chain attack on the elementary-data PyPI package using GitHub Actions injection to distribute a credential-stealing payload targeting data engineers.
Threat actors compromised the Axios npm package to deliver a multi-platform Remote Access Trojan (RAT) via the malicious dependency 'plain-crypto-js'.
The PowMix botnet targets Czech organizations using compliance-themed phishing lures and sophisticated PowerShell-based in-memory execution.
Threat actors are exploiting a zero-day vulnerability in Adobe Reader via malicious PDF files to execute privileged APIs and steal sensitive data, specifically targeting the Russian oil and gas sector.
JanelaRAT is an evolving variant of BX RAT targeting financial and cryptocurrency institutions in Latin America through DLL side-loading and sophisticated overlay attacks.
Threat actors compromised the axios npm package to deliver a multi-stage, cross-platform Remote Access Trojan (RAT) via a malicious dependency named plain-crypto-js.
An attacker uses a multi-stage fileless infection chain involving obfuscated VBScript and in-memory .NET loaders to deploy ScreenConnect for persistent remote access.
ClipBanker malware utilizes a complex, multi-stage infection chain starting from trojanized software on GitHub to swap cryptocurrency wallet addresses via clipboard monitoring.
The threat actor UAT-10362 is targeting Taiwanese NGOs and universities with a modular Lua-based stager called LucidRook and a reconnaissance tool named LucidKnight.
Threat actor TeamPCP compromised the LiteLLM AI proxy via a cascading supply chain attack originating from malicious GitHub Actions in the Trivy vulnerability scanner.
