Browse public community intelligence reports, source analysis, and threat research.
12 intel reports
Threat actors compromised LiteLLM's CI/CD pipeline by exploiting leaked GitHub CLI tokens in logs to distribute a malicious Python package containing the privcollect stealer and a RAT.
The threat actor RareWolf uses a multi-stage batch script to deploy AnyDesk for unauthorized remote access, archive local data, and exfiltrate information via SMTP using the Blat utility.
A China-linked operator utilized the AI-driven Cairn framework to conduct 66 intrusions against government and industry targets across Asia, leveraging LLM agents for automated exploitation.
Unauthenticated attackers are exploiting CVE-2026-104286, a critical path traversal vulnerability in FortiMail, to write arbitrary files and achieve persistent remote code execution.
Agent Tesla is a .NET-based spyware Trojan that steals credentials, keystrokes, and screenshots primarily through malicious email attachments.
Russian state-supported actors including LAUNDRY BEAR and TA458 are exploiting zero-day vulnerabilities in Zimbra, SOGo, and other webmail clients to exfiltrate sensitive email data from Western government and commercial targets.
Adversaries can exploit Azure Container Registry permissions to push malicious images, modify ACR Tasks, and abuse Managed Identities for secret exfiltration and remote code execution.
Akira ransomware actors utilized Bumblebee malware and AdaptixC2 via Bing SEO poisoning to gain initial access, move laterally, and exfiltrate over 75GB of data.
Bluekit PhaaS leverages advanced Browser-in-the-Middle (BitM) techniques and AI to bypass MFA by streaming live DOM interactions to victims.
The Drun Backdoor is a modular two-stage infostealer that utilizes the Chromelevator loader to inject into processes via direct syscalls, targeting browser credentials, session tokens, and gaming accounts.
