Browse public community intelligence reports, source analysis, and threat research.
297 intel reports
MiniRAT is a Go-based macOS remote access trojan delivered via the compromised velora-dex-sdk npm package, utilizing LaunchAgent persistence and AES-encrypted C2 configurations.
BlueNoroff is targeting Web3 and cryptocurrency executives using AI-generated deepfake meetings and ClickFix clipboard injection to deploy credential stealers.
Threat actors compromised the Axios npm package to deliver a multi-platform Remote Access Trojan (RAT) via the malicious dependency 'plain-crypto-js'.
A coordinated campaign of 36 malicious npm packages disguised as Strapi CMS plugins targets Guardarian cryptocurrency infrastructure to execute Redis RCE, steal database secrets, and establish persistent C2.
A coordinated campaign involving 108 malicious Chrome extensions uses shared C2 infrastructure to exfiltrate Telegram sessions, steal Google account identity, and maintain backdoors for remote URL injection.
Threat actor 0xFFF (aka alh1mik) has released notnullOSX, a modular Go-based macOS stealer and backdoor targeting high-value cryptocurrency users through ClickFix social engineering.
Threat actors compromised the axios npm package to deliver a multi-stage, cross-platform Remote Access Trojan (RAT) via a malicious dependency named plain-crypto-js.
Canis C2 is a previously undocumented cross-platform surveillance framework targeting Japanese users with sophisticated mobile agents and OS-specific fingerprinting.
Threat actor TeamPCP compromised multiple @fairwords npm packages to deploy CanisterWorm, a self-propagating malware that steals cloud credentials, crypto wallets, and Chrome passwords.
APT29 utilizes a multi-stage execution chain involving screensaver droppers, steganography-embedded payloads, and extensive memory manipulation to harvest credentials and move laterally.
