Browse public community intelligence reports, source analysis, and threat research.
169 intel reports
A cryptocurrency-mining campaign exploits CVE-2026-33017, an unauthenticated RCE in Langflow, to deploy a Go-based miner with aggressive defense evasion and lateral movement capabilities.
An unidentified threat actor is targeting Thailand's healthcare sector using healthcare-themed lures to deploy a Python-based information stealer via multi-stage batch scripts.
Pony is a long-standing credential stealer and downloader that targets various applications and uses dictionary attacks against local Windows accounts to deliver second-stage payloads like ZeuS.
A threat actor known as Poisson utilized Havoc C2 and Tailscale VPN to establish persistent, secondary access into French automotive and individual targets for credential theft.
The ROOTBOY actor is deploying Prinz Eugen, a technically deliberate Go-based ransomware that prioritizes fresh data and utilizes anti-forensics to evade detection.
The Mastra AI framework suffered a supply chain attack involving over 140 compromised npm packages that deliver a cross-platform infostealer via a typosquatted dependency.
The APT37 group is targeting South Korean users with NarwhalRAT, a multi-stage Python backdoor delivered via Microsoft-themed phishing and utilizing pCloud as a dead-drop resolver.
Attacker sergey2016 compromised the @mastra npm organization to inject the easy-day-js typosquat dependency, delivering an obfuscated postinstall dropper.
Amos Stealer targets macOS environments to harvest browser credentials, Apple Keychains, and developer configuration files using sophisticated AppleScript and shell script execution.
Team PCP's Miasma toolkit automates software supply chain attacks by poisoning package registries, hijacking GitHub Actions, and injecting malicious configurations into AI coding agents.
