Browse public community intelligence reports, source analysis, and threat research.
86 intel reports
Outsider Enterprise utilizes the JWR phishing framework, a variant of The Outsider, to perform real-time credential and PII theft through SMS lures and encrypted WebSockets.
Lucid Stealer is a Node.js-based information stealer and RAT that uses Single Executable Application packaging to deliver modular payloads for credential theft and remote control.
Twill Typhoon leverages a supply chain compromise of the QuickFox VPN proxy to deliver the FDMTP implant through multi-stage loaders and execution guardrails.
North Korean threat actors compromised two @joyfill npm packages to deliver the DEV#POPPER RAT and OmniStealer via a multi-chain blockchain C2 infrastructure.
Threat actors are deploying the NetSupport Manager RAT through a multi-stage chain involving phishing PDFs and obfuscated JavaScript to disguise legitimate binaries in a 'Stereo' folder.
Russian state-supported actors including LAUNDRY BEAR and TA458 are exploiting zero-day vulnerabilities in Zimbra, SOGo, and other webmail clients to exfiltrate sensitive email data from Western government and commercial targets.
PolinRider threat actors hijacked two Joyfill npm packages to distribute an obfuscated five-stage malware chain using blockchain-based C2 resolution and a Python credential stealer.
A Chinese-speaking threat actor (Asia-Pacific Group) is utilizing leaked DarkSword exploit kit source code to target iOS 18.4-18.7 devices using GHOSTBLADE malware.
Attackers compromised Adform's advertising tracking script trackpoint-async.js to replace cryptocurrency wallet addresses in user clipboards and web forms.
Russia-aligned actor TA488 is leveraging a critical XSS vulnerability in Outlook Web Access to deploy OWAReaper, a sophisticated browser-based implant for persistent mailbox access.
