Browse public community intelligence reports, source analysis, and threat research.
86 intel reports
Casbaneiro banking trojan targets Latin American users via geofenced phishing and a multi-stage AutoIt infection chain to exfiltrate financial credentials.
A self-proclaimed bug bounty hunter utilizes LLM-generated JavaScript malware named PhantomRaven to compromise developer environments via typosquatted npm packages for credential theft.
A Chinese-speaking operator uses the PEEP toolkit, a RedExt derivative, to transform Chromium browsers into persistent host-level backdoors via native-messaging bridges.
Threat actors are leveraging compromised WordPress sites and blockchain smart contracts to deliver Amatera password stealers and WebRTC stagers through ClickFix lures.
The BengalSEO group, linked to WeConnect Solutions and Garage2Global, utilizes sophisticated SEO poisoning and a custom Traffic Distribution System (TDS) to deploy MayaBot malware and tech support scams.
Threat actors associated with the Beamglea campaign are abusing the npm registry and unpkg mirrors to host malicious HTML files that simulate Cloudflare CAPTCHA pages to distribute ClickFix phishing malware.
The gaiadeqi.com campaign utilizes highly obfuscated JavaScript droppers to deliver credential-stealing trojans disguised as VLC Media Player installers.
ChainDrop, a descendant of the Shai-Hulud malware family, is a self-propagating npm worm targeting developer workstations and CI/CD pipelines to harvest cloud, registry, and AI tool credentials.
A suspected China-nexus actor, designated SilkParasite, utilizes a modular ecosystem of seven RAT families to target government economic bodies in Central Asia via DLL sideloading and Google Drive-backed C2.
The Offside Wallet Theft Factory campaign utilizes 77 malicious Firefox extensions to steal cryptocurrency secrets and credentials by masquerading as Web3 tools and sports-score utilities.
