Browse public community intelligence reports, source analysis, and threat research.
83 intel reports
Attackers compromised Adform's advertising tracking script trackpoint-async.js to replace cryptocurrency wallet addresses in user clipboards and web forms.
Russia-aligned actors Earth Dahu and SHADOW-EARTH-066 are exploiting a WinRAR path traversal vulnerability to deploy GIFTEDCROOK and espionage modules against Ukrainian organizations.
TAG-195 (Golden Chickens) has introduced a new generation of modular malware, including TinyEgg and ChonkyChicken, featuring enhanced browser credential theft and session automation via CDP.
Russian-affiliated threat actor CL-STA-1114 exploits a zero-click vulnerability in Zimbra Collaboration Suite to exfiltrate user credentials and email archives from global targets.
Stealth Falcon utilized an LLM-accelerated WebDAV delivery lab to deploy PureRAT via working directory hijacking and DLL sideloading targeting Mexican enterprise users.
Kimsuky targeted South Korean groupware vendors to compromise downstream customers using new Gomir malware variants and credential harvesting techniques.
Iranian-affiliated APT actors are targeting internet-exposed PLCs from Rockwell, Schneider, and Siemens to disrupt U.S. critical infrastructure via project file manipulation.
TELEPUZ is a full-featured modular malware spreading through CLICKFIX social engineering and VIDAR stealer, featuring advanced evasion and dead-drop resolver techniques.
DPRK-aligned threat actors are targeting developers with fake coding interviews that deliver OTTERCOOKIE malware via SVG-based steganography.
The popular ModHeader browser extension was discovered containing a dormant but fully functional pipeline for collecting, encrypting, and exfiltrating user browsing history.
