Browse public community intelligence reports, source analysis, and threat research.
86 intel reports
The China-aligned threat actor UNK_MassTraction is exploiting Roundcube vulnerabilities to deploy IceCube and VShell backdoors against US and Canadian university physics departments.
The emiltype actor published a malicious npm package nodemon-sudo that uses the dependency tslint-conf to fetch and execute a second-stage payload via IPFS at runtime.
The Veil#Drop framework utilizes a multi-stage infection chain involving JavaScript launchers and PowerShell cradles hosted on Blogspot to deploy PureLog Stealer in memory.
Turla (Secret Blizzard) targets government and military entities globally using the custom STOCKSTAY and Kazuar backdoors, often leveraging hijacked infrastructure.
Trojan FIXMAPI Loader is a reconnaissance stager delivered via trojanized Advanced Installer packages that impersonates Microsoft components to profile victims and beacon to C2 infrastructure.
A threat actor compromised a Mastra maintainer account to poison 140+ npm packages with a malicious dependency used for cross-platform backdoors and credential exfiltration.
Lazarus group deployed a cluster of malicious npm packages masquerading as Rollup polyfill tools to target developer workstations with a multi-stage remote access and data-stealing payload.
The StegoAd campaign utilized 119 malicious browser extensions to perform ad fraud and steal Google and WordPress credentials from 2.6 million users.
Threat actors are exploiting CVE-2026-48558 in SimpleHelp RMM software to deploy TaskWeaver and Djinn Stealer, targeting cloud, AI, and developer credentials across Windows, macOS, and Linux.
Lazarus-linked North Korean actors are targeting software developers via hijacked npm/Go packages and fraudulent job interviews to deploy the InvisibleFerret infostealer.
