Browse public community intelligence reports, source analysis, and threat research.
169 intel reports
Threat actors compromised the axios npm package to deliver a multi-stage, cross-platform Remote Access Trojan (RAT) via a malicious dependency named plain-crypto-js.
APT29 utilizes a multi-stage execution chain involving screensaver droppers, steganography-embedded payloads, and extensive memory manipulation to harvest credentials and move laterally.
A Chinese-speaking threat actor uses VoidLink, a modular AI-assisted framework, to deploy hybrid LKM/eBPF rootkits for kernel-level stealth and ICMP-based C2 on Linux systems.
North Korean actor Sapphire Sleet compromised the popular Axios npm package to deliver platform-specific RATs via a malicious dependency named plain-crypto-js.
The FAUX#ELEVATE campaign uses heavily obfuscated VBScript lures targeting French corporate environments to deploy a multi-stage toolkit including XMRig miners and browser credential stealers.
A Russian-origin .NET remote access toolkit named CTRL uses weaponized LNK files to deploy modular payloads for credential theft, RDP session hijacking, and FRP-based reverse tunneling.
Aura Stealer is a sophisticated C++ info-stealer utilizing five obfuscation layers and Heaven's Gate techniques to target Chromium browsers and crypto wallets.
Threat actor TeamPCP compromised the Trivy vulnerability scanner and associated GitHub Actions to exfiltrate cloud and CI/CD credentials via poisoned tags and binaries.
The GhostClaw malware campaign has expanded its delivery from npm packages to malicious GitHub repositories and AI-assisted developer workflows to steal macOS credentials.
