Browse public community intelligence reports, source analysis, and threat research.
86 intel reports
Threat actors are exploiting CVE-2026-48558 in SimpleHelp RMM to deploy TaskWeaver, a modular Node.js loader, and Djinn Stealer, a cross-platform information stealer targeting developer and AI credentials.
An active phishing campaign targets hospitality organizations in Europe and Asia using photo-themed ZIP files to deliver a Node.js-based implant called TonRAT.
The Miasma worm campaign compromised 20 LeoPlatform npm packages and a Verana Blockchain Go module to deploy a Bun-based credential stealer targeting developer environments and CI/CD pipelines.
The MexicanMafia threat actor, also known as PanchoVilla, is conducting a sophisticated campaign using the Kimera reconnaissance engine and custom exploits against perimeter devices in Latin America.
The AutoJack exploit chain leverages a confused deputy browsing agent to bypass localhost trust boundaries and achieve RCE in Microsoft's AutoGen Studio.
The Mastra AI framework suffered a supply chain attack involving over 140 compromised npm packages that deliver a cross-platform infostealer via a typosquatted dependency.
Attacker sergey2016 compromised the @mastra npm organization to inject the easy-day-js typosquat dependency, delivering an obfuscated postinstall dropper.
KongTuke and PS1Bot campaigns leverage malicious browser extensions and malvertising to deliver modular RATs and information stealers targeting Windows and macOS systems.
Team PCP's Miasma toolkit automates software supply chain attacks by poisoning package registries, hijacking GitHub Actions, and injecting malicious configurations into AI coding agents.
TeamPCP uses the Miasma worm to compromise developers and CI/CD pipelines by hijacking AI coding agents and poisoning package registries.
