Browse public community intelligence reports, source analysis, and threat research.
86 intel reports
The Astaroth (Guildma) banking trojan has integrated a new browser-automated WhatsApp Web spambot to propagate malware through trusted social contacts, primarily targeting Brazilian users.
The Chaos ransomware group is using a new Rust-based RAT called msaRAT that establishes covert C2 channels by hijacking headless Chrome and Edge browsers via the Chrome DevTools Protocol.
The PhantomEnigma campaign leverages compromised Brazilian .gov.br infrastructure to deliver a modular Node.js backdoor aimed at banking credential theft.
Unauthenticated attackers can achieve remote code execution in ServiceNow AI Platform by escaping a script sandbox through a pre-authentication endpoint and gadget chain.
A global campaign uses heavily obfuscated JScript and AutoIt/Lua-based loaders disguised as .ttf files to deploy multiple RATs and infostealers via fileless execution.
Anonymous researcher 'bikini' released Exploitarium, a repository containing over 30 proof-of-concept exploits for unpatched vulnerabilities across multiple software projects, including critical flaws in libssh2 and Gitea.
The SuccessKey threat actor is targeting Vite ecosystem developers using malicious scoped npm packages that deliver a Remote Access Trojan (RAT) via a multi-tier blockchain C2 infrastructure.
DPRK-aligned threat actors are targeting developers with fake coding interviews that deliver OTTERCOOKIE malware via SVG-based steganography.
The Miasma v3 malware is currently targeting AsyncAPI npm packages via a compromised GitHub Actions release workflow to deliver a persistent Node.js remote access trojan.
A sophisticated supply chain attack compromised the AsyncAPI npm organization to distribute the Miasma multi-stage dropper, targeting developers for credential theft and lateral movement.
