Browse public community intelligence reports, source analysis, and threat research.
59 intel reports
The Shai-Hulud worm compromised the tensorlake npm package to exfiltrate secrets and cryptocurrency browser data while implementing a destructive 'dead-man's switch' upon token revocation.
The Shai-Hulud worm compromised the tensorlake npm package to steal developer credentials, AI tool configurations, and implement a self-destruct mechanism triggered by token revocation.
Threat actors compromised LiteLLM's CI/CD pipeline by exploiting leaked GitHub CLI tokens in logs to distribute a malicious Python package containing the privcollect stealer and a RAT.
Glassworm threat actors compromised a contributor's GitHub account to replace official OVHcloud CLI release binaries with secret-stealing malware using a Solana-based dead drop for command and control.
The SleepyDuck operation leverages fake Solidity VS Code extensions and steganographic MP4 files to deliver evjawbreaker implants and ScreenConnect backdoors.
Suspected TraderTraitor group targets developers using trojanized Terraform providers to deliver cross-platform FLATROOF and ROOFDECK malware via lookalike domains and GitHub.
Threat actors associated with Vice Society are utilizing ClickFix social engineering to deploy Lorem Ipsum Loader and Python-based tunnels for network access.
A compromised version of the Tensorlake npm package (v0.5.144) distributes the Shai-Hulud worm to steal developer credentials and crypto-wallets while utilizing Ethereum smart contracts for C2 agility.
Earth Sirrush (UAC-0099) utilizes evolving .NET malware, steganographic delivery, and trojanized applications to target Ukrainian government and logistics sectors for long-term espionage.
The suspected TraderTraitor group is using trojanized Terraform providers to deliver cross-platform FLATROOF and ROOFDECK malware for credential theft and persistent access.
