Browse public community intelligence reports, source analysis, and threat research.
120 intel reports
China-nexus actor UAT-7810 is expanding its LapDogs Operational Relay Box network using new malware families like LONGLEASH and DOGLEASH to target networking and IoT devices.
Void Dokkaebi targets software developers by injecting obfuscated JavaScript malware into configuration files like tailwind.config.js to establish command-and-control via blockchain APIs.
An isolated malware dropper, ascii-fetcher, utilizes a malicious npm dependency named @jaymara/jsononifier to execute XOR-encoded commands on Windows systems via VS Code.
The ChocoPoC threat actor is targeting security researchers with trojanized GitHub PoC repositories that install malicious PyPI packages to deliver a Python-based RAT.
The North Korean-linked PolinRider campaign has expanded its supply chain targeting across npm, Packagist, Go modules, and Chrome extensions to deploy the DEV#POPPER and OmniStealer malware.
An attacker uses indirect prompt injection in a benign-looking repository to trick the Claude Code agent into executing a reverse shell fetched via DNS TXT records.
The ToddyCat APT group utilizes Umbrij malware to compromise corporate Gmail accounts by leveraging a technique called Shadow Token via Remote Debug (STRD) to steal OAuth tokens.
An unauthenticated remote code execution vulnerability in the Argo CD repo-server component allows attackers with internal network access to take over Kubernetes clusters.
SystemBC is a Windows-based malware family used as a SOCKS5 proxy and persistent RAT by major ransomware groups to tunnel malicious traffic and execute payloads.
The 'Adblock for YouTube' Chrome extension uses excessive permissions and a remote-controlled injection architecture that could be weaponized for arbitrary code execution on any website.
