Browse public community intelligence reports, source analysis, and threat research.
217 intel reports
The Shai-Hulud worm compromised the tensorlake npm package to exfiltrate secrets and cryptocurrency browser data while implementing a destructive 'dead-man's switch' upon token revocation.
The Shai-Hulud worm compromised the tensorlake npm package to steal developer credentials, AI tool configurations, and implement a self-destruct mechanism triggered by token revocation.
Affiliates of INC and The Gentlemen ransomware groups are using an AI-orchestrated infrastructure featuring the 'Phantom' autonomous red team framework to exploit edge devices and deploy ransomware.
A suspected Chinese threat actor is using SEO poisoning targeting DeepSeek AI users to deliver Kong RAT through a complex multi-stage infection chain.
APT28 (Swallowtail) is executing a complex cyber espionage campaign targeting NATO naval and aerospace manufacturers using the Hookedge backdoor and a novel reflective loader.
The n0n ransomware group utilizes AI coding agents and credential-based access to target global organizations, frequently destroying data and backups when encryption is not feasible.
An SEO poisoning campaign utilizes fake Chocolatey and Microsoft Activation Scripts websites to deliver Armorsteal, a modular Python-based stealer and remote access tool.
C2Agent is a sophisticated Go-based Windows malware that utilizes Large Language Models (LLMs) and the Model Context Protocol (MCP) to interactively drive post-exploitation activities.
Attackers are abusing Microsoft Power BI dashboards to host malicious links that deliver redundant ScreenConnect RMM installers for persistent remote access.
An extensive phishing campaign impersonating the U.S. District Court targets over 100,000 companies using personalized lures to deliver the LodaRAT remote access trojan via malicious ISO files.
