Browse public community intelligence reports, source analysis, and threat research.
86 intel reports
An ongoing malicious npm campaign involving 'indexed-btree' and other packages bypasses lifecycle script defenses by burying loaders in runtime prototype methods and using Ethereum smart contracts for C2.
Adversary Pursuit Group identified ChainScript, a Node.js RAT that utilizes Polygon smart contracts for resilient C2 infrastructure rotation and delivery via ClickFix lures.
Unknown actors compromised MemTensor packages on npm and PyPI to deliver 'sckit', a Go-based worm designed for credential harvesting and self-propagation via CI/CD pipelines.
The North Korean WaterPlum group uses fake job interviews and malicious development tools to compromise IT professionals, stealing over $10.7 million in cryptocurrency.
An unauthenticated visitor can exploit a flaw in the wpautop() function of WordPress core to plant a stored XSS payload that escalates to RCE when viewed by an administrator.
PamStealer targets macOS users via fake 'Wavel' crypto wallet lures, utilizing a novel live server-side decryption utility (pkgunpack) and a Swift-based infostealer payload.
Suspected North Korean threat actors are using 13 malicious npm packages to deliver WeaselBiscuit, a lightweight stealer targeting Chrome extension storage and system metadata.
Kimsuky (APT-C-55) utilizes multi-stage PowerShell and C# malware delivered via disguised installers to target South Korean institutions for intelligence theft.
Researchers at pwn.ai discovered the Click2Shell attack chain, which leverages a WordPress core selector injection vulnerability to force theme installations and achieve remote code execution through theme-specific flaws.
LausivLoader utilizes a multi-stage infection chain involving JavaScript, PowerShell, and .NET, leveraging environment variable inheritance for inter-process data handoff and steganography to deliver final payloads.
