Browse public community intelligence reports, source analysis, and threat research.
115 intel reports
A sophisticated multi-stage campaign uses HijackLoader to deploy Vidar infostealers and the SnappyClient RAT via DLL side-loading and process hollowing.
Threat actors are using multi-stage AutoIT scripts delivered via phishing to inject VIPKeylogger and MedusaHVNC into legitimate Windows processes like charmap.exe.
Russia-aligned actors Earth Dahu and SHADOW-EARTH-066 are exploiting a WinRAR path traversal vulnerability to deploy GIFTEDCROOK and espionage modules against Ukrainian organizations.
The FakeGit campaign leverages 7,600 malicious GitHub repositories and the 'AgentBaiting' technique to trick AI agents into recommending SmartLoader and StealC malware.
A new Windows infostealer called Dolphin X, sold by the actor Kontraktnik, uses AI-driven triage to prioritize high-value corporate and DevOps targets.
The FakeAgent campaign utilizes malicious Claude.ai artifacts and SEO poisoning to deliver SectopRAT through DLL sideloading and blockchain-based C2 infrastructure.
Blind Eagle (APT-C-36) is utilizing a modernized JC-46 AsyncRAT build featuring WNF process injection and a Chrome App-Bound Encryption bypass to target Latin American financial interests.
A global campaign uses heavily obfuscated JScript and AutoIt/Lua-based loaders disguised as .ttf files to deploy multiple RATs and infostealers via fileless execution.
ACR Stealer (formerly Amatera Stealer) employs ClickFix social engineering, WebDAV delivery, and steganography to steal browser credentials and sensitive documents from Windows and macOS environments.
The SuccessKey threat actor is targeting Vite ecosystem developers using malicious scoped npm packages that deliver a Remote Access Trojan (RAT) via a multi-tier blockchain C2 infrastructure.
