Browse public community intelligence reports, source analysis, and threat research.
98 intel reports
Threat actors including GOLD ENCOUNTER and campaigns STAC4713/STAC3725 are abusing QEMU virtualization to hide backdoors and deploy PayoutsKing and 3AM ransomware.
Threat actor 0xFFF (aka alh1mik) has released notnullOSX, a modular Go-based macOS stealer and backdoor targeting high-value cryptocurrency users through ClickFix social engineering.
Threat actors compromised the axios npm package to deliver a multi-stage, cross-platform Remote Access Trojan (RAT) via a malicious dependency named plain-crypto-js.
Canis C2 is a previously undocumented cross-platform surveillance framework targeting Japanese users with sophisticated mobile agents and OS-specific fingerprinting.
The threat actor UAT-10362 is targeting Taiwanese NGOs and universities with a modular Lua-based stager called LucidRook and a reconnaissance tool named LucidKnight.
The EvilTokens Phishing-as-a-Service platform is weaponizing Railway.com PaaS infrastructure to conduct large-scale OAuth token replay and device code phishing campaigns against Microsoft 365 environments.
Threat actor TeamPCP compromised the 'telnyx' PyPI package to distribute credential-stealing malware using WAV steganography.
A sophisticated PureLog Stealer campaign uses localized copyright violation lures and a multi-stage, fileless execution chain to target multiple global sectors.
