Browse public community intelligence reports, source analysis, and threat research.
79 intel reports
RondoDox, TerraBot, and r00ts3c botnets are actively weaponizing legacy IoT vulnerabilities and modern enterprise flaws like Log4Shell using compromised residential infrastructure.
A cryptocurrency-mining campaign exploits CVE-2026-33017, an unauthenticated RCE in Langflow, to deploy a Go-based miner with aggressive defense evasion and lateral movement capabilities.
Adversaries are leveraging the ClickFix social engineering technique to deploy the AMOS infostealer on macOS and malicious PowerShell payloads on Windows via clipboard hijacking.
A new macOS ClickFix campaign uses social engineering to trick users into running Terminal commands that silently mount DMGs and execute the Atomic macOS Stealer (AMOS).
A Russian-speaking attacker is deploying the Meow AppleScript RAT via ClickFix social engineering lures to exfiltrate data and hijack cryptocurrency wallets on macOS.
The MexicanMafia threat actor, also known as PanchoVilla, is conducting a sophisticated campaign using the Kimera reconnaissance engine and custom exploits against perimeter devices in Latin America.
The AutoJack exploit chain leverages a confused deputy browsing agent to bypass localhost trust boundaries and achieve RCE in Microsoft's AutoGen Studio.
The MovieBox Android malware masquerades as a premium streaming service to perform advanced reconnaissance, data exfiltration, and UI overlay attacks.
A critical argument injection vulnerability in Gogs allows authenticated users to achieve RCE by injecting the --exec flag into git rebase during pull request operations.
The threat actor Mr_Rot13 is exploiting a critical cPanel authentication bypass (CVE-2026-41940) to deploy Go-based infectors and the 'filemanager' remote access trojan.
