Browse public community intelligence reports, source analysis, and threat research.
13 intel reports
Threat actors compromised LiteLLM's CI/CD pipeline by exploiting leaked GitHub CLI tokens in logs to distribute a malicious Python package containing the privcollect stealer and a RAT.
Threat actors Storm-3121 and Storm-3032 utilize passkey-themed social engineering and AiTM phishing to compromise Microsoft cloud identities for automated data exfiltration via Microsoft Graph.
Threat actor UNK_SneakyStrike is using the TeamFiltration framework to conduct large-scale password-spraying attacks against Microsoft Entra ID accounts globally.
Adversaries leverage ClickFix social engineering, ClearFake etherhiding, and SNEAKY2FA AiTM phishing to deliver malware and hijack sessions.
The TeamPCP threat group utilized backdoored TanStack npm packages to harvest credentials from a former CrowdSec employee, leading to the theft of 170 private GitHub repositories.
PREY-0058 (UNC6671) uses help-desk vishing and AiTM phishing to steal Microsoft 365 session tokens for bulk data exfiltration from SharePoint and Exchange via residential proxies.
Storm-2755 (Payroll Pirates) uses AiTM phishing and Microsoft Graph reconnaissance to hijack Microsoft 365 sessions and divert employee salaries.
Storm-2755 (Payroll Pirates) uses AiTM phishing and residential proxies to compromise Microsoft 365 accounts for financial data theft and payroll diversion.
Multiple campaigns are using ghost accounts and compromised tokens to systematically enumerate and exfiltrate private data from GitHub organizations.
Threat actors Storm-2755 and Storm-2657 utilize AiTM session theft and Microsoft Graph API reconnaissance to execute financial theft by redirecting payroll payments.
