Browse public community intelligence reports, source analysis, and threat research.
297 intel reports
A Russian-speaking attacker is deploying the Meow AppleScript RAT via ClickFix social engineering lures to exfiltrate data and hijack cryptocurrency wallets on macOS.
The ErrTraffic Malware-as-a-Service framework uses the ClickFix social engineering tactic and EtherHiding blockchain dead-drop resolvers to distribute infostealers and loaders through compromised WordPress sites and fake AI platforms.
UNC6508, a PRC-nexus threat actor, targets medical and military research institutions using INFINITERED malware to harvest credentials and exfiltrate data via manipulated compliance rules.
The MexicanMafia threat actor, also known as PanchoVilla, is conducting a sophisticated campaign using the Kimera reconnaissance engine and custom exploits against perimeter devices in Latin America.
The Mastra AI framework suffered a supply chain attack involving over 140 compromised npm packages that deliver a cross-platform infostealer via a typosquatted dependency.
Dropping Elephant is using a China-themed decoy document to deliver a heavily reworked, in-memory RAT via DLL side-loading and Donut shellcode.
The APT37 group is targeting South Korean users with NarwhalRAT, a multi-stage Python backdoor delivered via Microsoft-themed phishing and utilizing pCloud as a dead-drop resolver.
Attacker sergey2016 compromised the @mastra npm organization to inject the easy-day-js typosquat dependency, delivering an obfuscated postinstall dropper.
An attacker compromised the CDN API keys of OptinMonster, TrustPulse, and PushEngage to serve tampered JavaScript that creates rogue admin accounts on customer sites.
Amos Stealer targets macOS environments to harvest browser credentials, Apple Keychains, and developer configuration files using sophisticated AppleScript and shell script execution.
