Browse public community intelligence reports, source analysis, and threat research.
115 intel reports
Threat actors including Stardust Chollima and Sandworm are utilizing 'Browser Cache Smuggling' to deliver malware like Vidar Stealer and GeniexRAT by pre-fetching payloads into browser caches to bypass security scans and character limits.
C2Agent is a sophisticated Go-based Windows malware that utilizes Large Language Models (LLMs) and the Model Context Protocol (MCP) to interactively drive post-exploitation activities.
A new ClickFix variant uses browser cache smuggling to bypass Windows Run dialog character limits and deploy in-memory .NET credential stealers.
The Yoba campaign utilizes SEO-poisoned GitHub repositories and fake AI desktop applications to distribute a custom loader that delivers XMRig miners via DLL sideloading.
VulcanRAT207.B leverages RomulusLoader and signed VulkanInfo binaries to establish persistent remote access and kernel-level evasion on Windows systems.
The XWorm 6.0 modular malware has resurfaced with over 35 plugins for data theft, ransomware, and persistence, primarily targeting Windows systems via phishing and malicious installers.
The Lazarus Group is targeting South Korean sectors by exploiting mandatory financial security software to deploy a sophisticated malware framework featuring post-quantum encryption.
Adversary c05d5254 uses the PoisonedRefresh rootkit to inject fileless PHP web shells into F5 BIG-IP APM memory via CVE-2025-53521 exploitation.
Threat actors associated with Vice Society are utilizing ClickFix social engineering to deploy Lorem Ipsum Loader and Python-based tunnels for network access.
CrocoRat is a Python-based remote access trojan and cryptocurrency stealer delivered via ClickFix social engineering and novel DNS TXT record payload staging.
