Browse public community intelligence reports, source analysis, and threat research.
13 intel reports
Affiliates of INC and The Gentlemen ransomware groups are using an AI-orchestrated infrastructure featuring the 'Phantom' autonomous red team framework to exploit edge devices and deploy ransomware.
The GlowComa threat actor is distributing ICMacOS, a macOS-targeted Malware-as-a-Service that has evolved from an information stealer into a persistent Remote Access Trojan (RAT).
China-based threat actors are deploying RatHat, a sophisticated Android Trojan that leverages generative AI for UI automation and ADB self-pairing for persistent shell access.
The Phexia threat actor uses fake CAPTCHA 'ClickFix' lures to deploy a macOS backdoor that resolves its C2 hostname via a Polygon smart contract and drops multiple infostealers.
PamStealer targets macOS users via fake 'Wavel' crypto wallet lures, utilizing a novel live server-side decryption utility (pkgunpack) and a Swift-based infostealer payload.
TWINLOOT is a sophisticated Python implant utilizing SharePoint for tasking, Teams TURN relays for SOCKS5 tunneling, and headless Edge for stealthy Microsoft Graph API transport.
The Offside Wallet Theft Factory campaign utilizes 77 malicious Firefox extensions to steal cryptocurrency secrets and credentials by masquerading as Web3 tools and sports-score utilities.
AmnesiaStealer is a multi-stage Rust-based macOS infostealer that uses ClickFix lures and a remote streaming module to gain live, hidden control of Chromium browsers.
BlueNoroff is utilizing an advanced phishing kit to impersonate Zoom and Microsoft Teams, profiling cryptocurrency wallets before delivering tailored malware to high-value targets.
Apex Foundation is distributing a macOS infostealer via npm packages and a fake MCP server, targeting Web3 founders with an AI-advisor lure.
