Browse public community intelligence reports, source analysis, and threat research.
30 intel reports
An unknown actor used a compromised ConnectWise Cloud Backup (SkyKick) application credential to sign in to customer Microsoft 365 tenants as the application itself, with Huntress reporting successful sign-ins in over 300 tenants.
An unattributed threat actor used AiTM phishing and device code flows to steal M365 session tokens, replaying them to register rogue devices and wipe MFA methods across 79 organizations.
Unknown threat actors compromised ConnectWise Cloud Backup application identities to gain unauthorized access to Microsoft 365 tenants across multiple sectors.
Zeabur is permanently shutting down following an October 2026 breach that exposed 3.2 million secrets and granted attackers root access to customer infrastructure via compromised administrative credentials.
Glassworm threat actors compromised a contributor's GitHub account to replace official OVHcloud CLI release binaries with secret-stealing malware using a Solana-based dead drop for command and control.
Helix extortion group uses vishing and device code phishing to compromise identities and automate bulk data exfiltration from SharePoint environments.
An AI-assisted threat actor achieved full AWS environment compromise in 72 hours by chaining credential harvesting, CI/CD exploitation, and automated reconnaissance.
ShinyHunters has evolved from a credential-theft crew into a resilient extortion brand and SaaS supply-chain threat, most recently exploiting PeopleSoft zero-days and third-party OAuth tokens.
Storm-3168 (JADEPUFFER) utilizes compromised service principals to automate resource discovery, destruction, and credential theft across Microsoft Azure environments.
A suspected China-based threat actor exploited file upload vulnerabilities in a recreation management platform to deploy webshells and steal payment card data.
