Browse public community intelligence reports, source analysis, and threat research.
79 intel reports
Threat actors are actively exploiting a decade-old improper access control vulnerability in ProFTPD's mod_copy module to achieve unauthenticated remote code execution on Linux/Unix systems.
Threat actor marchos1as uploaded typosquatted AUR packages impersonating yay and paru to execute malicious scripts delivering the CHAOS remote access trojan.
Threat actors are exploiting a remote code execution vulnerability in REDCap servers (CVE-2026-90817) to deploy XMRig miners using fileless techniques and steganography.
The GlowComa threat actor is distributing ICMacOS, a macOS-targeted Malware-as-a-Service that has evolved from an information stealer into a persistent Remote Access Trojan (RAT).
The suspected TraderTraitor group is using trojanized Terraform providers to deliver cross-platform FLATROOF and ROOFDECK malware for credential theft and persistent access.
UNC6240 (ShinyHunters) is conducting mass exploitation of CVE-2026-35273 in Oracle PeopleSoft using WAF bypass techniques to deploy SIDEEYE backdoors and MeshCentral agents for extortion.
Unauthenticated attackers are exploiting CVE-2026-73570 in Zimbra Collaboration Suite to deploy JSP webshells, escalate privileges via PAM, and exfiltrate mailbox data.
A vulnerability chain in OnePlus OxygenOS allows a no-permission malicious app to achieve full root access by exploiting AtlasService and a vendor-specific olc2 HAL.
The Macfinger ClickFix campaign targets macOS users by injecting scripts into legitimate websites to deploy Atomic macOS Stealer (AMOS) via fake browser verification prompts.
Unknown actors compromised MemTensor packages on npm and PyPI to deliver 'sckit', a Go-based worm designed for credential harvesting and self-propagation via CI/CD pipelines.
