Browse public community intelligence reports, source analysis, and threat research.
9 intel reports
An unknown actor used a compromised ConnectWise Cloud Backup (SkyKick) application credential to sign in to customer Microsoft 365 tenants as the application itself, with Huntress reporting successful sign-ins in over 300 tenants.
Storm-3119 (YAM Store) acts as a power broker selling compromised Microsoft 365 and Google infrastructure to Storm-2990, who develops and operates global Phishing-as-a-Service (PaaS) kits.
Storm-2992 operates EvilTokens, an AI-driven Phishing-as-a-Service platform targeting Microsoft 365 through device code authentication abuse to facilitate business email compromise.
The threat actor Storm-2372 is utilizing AI-built phishing kits, TokenLover and YaksaLover, to automate large-scale BEC attacks and persistence via Windows Hello for Business key injection.
Adversaries utilize various AWS-native features including IAM users, cross-account roles, Lambda backdoors, and federated sessions to maintain long-term persistence in victim cloud environments.
Sophisticated threat actor UAT-8616 is targeting Cisco Catalyst SD-WAN components using zero-day vulnerabilities to gain root access and manipulate network fabric configurations.
The EvilTokens and ARToken Phishing-as-a-Service (PhaaS) platforms use Microsoft Device Code flows and browser-side decryption to bypass MFA and achieve persistent Microsoft 365 account takeovers.
ARToken is an EvilTokens-linked Phishing-as-a-Service platform that uses Microsoft OAuth Device Code grants to capture Primary Refresh Tokens (PRTs) for persistent access and BEC operations.
A critical argument injection vulnerability in Gogs allows authenticated users to achieve RCE by injecting the --exec flag into git rebase during pull request operations.
