Browse public community intelligence reports, source analysis, and threat research.
51 intel reports
CRPx0 is a sophisticated cross-platform ransomware-as-a-service operation using ClickFix social engineering lures to deliver multi-stage Python-based payloads via clipboard hijacking.
LiteLLM vulnerabilities (CVE-2026-59821, CVE-2026-59822) enable unauthenticated attackers to bypass security controls, achieve root-level RCE, and exfiltrate cloud IAM credentials.
Mini Shai-Hulud threat actors compromised the '@7nohe/openapi-react-query-codegen' npm package by abusing comment-triggered GitHub Actions workflows to publish malicious versions targeting cloud and registry credentials.
SynkLoader is a modular Windows malware family distributed via Microsoft Teams phishing that uses a bundled Python environment and in-memory components to facilitate credential theft, tunneling, and remote access.
Adversa AI researchers identified a new attack technique, Cryptographic Context Injection, that bypasses AI guardrails by using code execution runtimes to decrypt malicious instructions stored in ciphertext.
UNC5142 utilizes a Python-based RAT named DeviceManager, delivered via ClickFix campaigns, leveraging Ethereum smart contracts for resilient C2 infrastructure resolution and DNS for communication.
pyCodeV3 is a multi-stage Python loader using dynamic domain generation and pickle deserialization to execute arbitrary code from C2 servers.
The WhiteCobra threat actor is deploying malicious 'Solidity Pro' VS Code extensions that evolve from Cloudflare-hosted Python droppers to comprehensive credential and wallet infostealers.
North Korean threat actors compromised two @joyfill npm packages to deliver the DEV#POPPER RAT and OmniStealer via a multi-chain blockchain C2 infrastructure.
PolinRider threat actors hijacked two Joyfill npm packages to distribute an obfuscated five-stage malware chain using blockchain-based C2 resolution and a Python credential stealer.
