Browse public community intelligence reports, source analysis, and threat research.
297 intel reports
Threat actors including Aeternum are exploiting CVE-2026-26980 in Ghost CMS to inject malicious JavaScript loaders that facilitate ClickFix social engineering attacks and malware delivery.
Financially motivated actors are using SEO poisoning to impersonate AI tools like Gemini and Claude Code, delivering a fileless PowerShell infostealer to developer workstations.
The threat actor JINX-0164 targets cryptocurrency industry developers using sophisticated macOS-specific malware, CI/CD compromise, and social engineering to steal digital assets and credentials.
Threat actor UNG0002 is targeting Chinese universities using spear-phishing lures related to national fitness standards to deliver Cobalt Strike via DLL side-loading.
Twill Typhoon is conducting a modular intrusion campaign in the APJ region using updated FDMTP backdoors and DLL sideloading via legitimate binaries like Sogou Pinyin and ClickOnce.
Chinese-speaking threat actor lwxat operates a Malware-as-a-Service (MaaS) ecosystem centered on BadIIS, targeting web servers for SEO fraud and malicious redirection.
The Belarus-aligned actor FrostyNeighbor is targeting Ukrainian governmental organizations using updated PicassoLoader variants and victim-validated delivery chains.
The KongTuke group is leveraging Microsoft Teams social engineering to deploy ModeloRAT, escalate privileges via CVE-2023-36036, and harvest domain credentials using fake Windows lock screens.
Gamaredon (UAC-0010) is utilizing spearphishing emails and the CVE-2025-8088 WinRAR vulnerability to deploy GammaDrop and GammaLoad malware against Ukrainian state institutions.
LAPSUS$ and TeamPCP targeted Checkmarx developer artifacts and GitHub repositories to exfiltrate credentials and distribute malicious plugins via the Jenkins Marketplace and OpenVSX registry.
