Browse public community intelligence reports, source analysis, and threat research.
30 intel reports
A confused deputy vulnerability in Google Cloud's Config Connector (KCC) allows Kubernetes users to escalate privileges to Organization Owner by submitting malicious IAMPolicyMember YAML files.
The TeamPCP threat group utilized backdoored TanStack npm packages to harvest credentials from a former CrowdSec employee, leading to the theft of 170 private GitHub repositories.
Threat actors are actively exploiting critical arbitrary file upload vulnerabilities in Super Forms and Elementor Pro plugins to deploy the Mushr00w PHP uploader and seize control of WordPress sites.
Unauthorized threat actors exploited a critical vulnerability (CVE-2026-63077) in the JetBrains Cadence service to access customer source code, credentials, and personal data.
The Knight Office phishing kit uses Adversary-in-the-Middle (AiTM) techniques and device code phishing to bypass MFA and hijack Microsoft 365 session tokens.
Threat actors associated with the Beamglea campaign are abusing the npm registry and unpkg mirrors to host malicious HTML files that simulate Cloudflare CAPTCHA pages to distribute ClickFix phishing malware.
Storm-2755 (Payroll Pirates) uses AiTM phishing and Microsoft Graph reconnaissance to hijack Microsoft 365 sessions and divert employee salaries.
ShinyHunters is targeting healthcare organizations using vishing to compromise SSO identities (Entra, Okta, Google) for rapid SaaS data exfiltration and extortion.
HOLLOWGRAPH malware utilizes Microsoft Graph API to abuse Microsoft 365 calendars as a command-and-control channel for tasking and exfiltration.
The threat actor ShinyHunters and affiliated clusters are targeting SaaS platforms, specifically Salesforce, using vishing and OAuth integration abuse for data exfiltration and extortion.
