Browse public community intelligence reports, source analysis, and threat research.
269 intel reports
A Chinese-speaking threat actor uses VoidLink, a modular AI-assisted framework, to deploy hybrid LKM/eBPF rootkits for kernel-level stealth and ICMP-based C2 on Linux systems.
The FAUX#ELEVATE campaign uses heavily obfuscated VBScript lures targeting French corporate environments to deploy a multi-stage toolkit including XMRig miners and browser credential stealers.
Atomic Stealer (AMOS) leverages a new macOS persistence mechanism, anti-VM evasion, and trojanized hardware wallet applications to exfiltrate sensitive data and crypto credentials.
North Korean-linked EtherRAT utilizes 'EtherHiding' via Ethereum smart contracts to manage resilient C2 infrastructure for host fingerprinting and asset theft.
A South Asian financial institution was targeted by an emerging actor using BRUSHWORM, a modular backdoor with USB spreading capabilities, and BRUSHLOGGER, a side-loaded keylogger.
A widespread initial access campaign using fraudulent human-verification prompts to trick victims into executing malicious commands via native system tools.
The GhostClaw malware campaign has expanded its delivery from npm packages to malicious GitHub repositories and AI-assisted developer workflows to steal macOS credentials.
A sophisticated PureLog Stealer campaign uses localized copyright violation lures and a multi-stage, fileless execution chain to target multiple global sectors.
An ongoing campaign, dubbed ForceMemo, compromises developer GitHub accounts to inject malware into Python repositories using a stealthy force-push technique and a Solana-based C2.
