Browse public community intelligence reports, source analysis, and threat research.
30 intel reports
Adversaries can exploit Azure Container Registry permissions to push malicious images, modify ACR Tasks, and abuse Managed Identities for secret exfiltration and remote code execution.
Multiple campaigns are using ghost accounts and compromised tokens to systematically enumerate and exfiltrate private data from GitHub organizations.
An unidentified threat actor launched an 81-million attempt password spray campaign against Microsoft 365 via Azure CLI, leveraging LSHIY LLC infrastructure.
Threat actors Storm-2755 and Storm-2657 utilize AiTM session theft and Microsoft Graph API reconnaissance to execute financial theft by redirecting payroll payments.
Amazon Q Developer and several AI coding assistants were found vulnerable to arbitrary code execution and cloud credential theft via the automatic loading of Model Context Protocol (MCP) server configurations.
The Storm-2372 threat actor and security researchers bypass Microsoft Entra ID Conditional Access by registering phantom devices and spoofing Intune compliance claims.
Midnight Blizzard leverages compromised Entra ID Agent Blueprints to pivot between tenants and escalate to Global Administrator using Temporary Access Passes.
The Storm-1747 threat actor uses the Tycoon 2FA AiTM phishing kit to bypass multi-factor authentication and maintain persistence in Microsoft 365 and Google Workspace environments.
Storm-1747 utilizes Tycoon 2FA to bypass MFA and maintain persistence through device registration and session token theft targeting Microsoft and Google cloud environments.
Threat actor link99 systematically exploits abandoned Azure and DigitalOcean DNS zone delegations to host Thai gambling platforms under the authority of over 160 enterprise and government domains.
