Browse public community intelligence reports, source analysis, and threat research.
240 intel reports
The Macfinger ClickFix campaign targets macOS users by injecting scripts into legitimate websites to deploy Atomic macOS Stealer (AMOS) via fake browser verification prompts.
Iranian state cyber actors are using CHOSEN BRICK, a Windows-based spyware, to monitor dissidents and activists through social engineering and Telegram-based command and control.
Konni, a DPRK-nexus actor, is targeting Ukrainian entities using socio-economic lures to deploy VelvetCake, a modular PowerShell-based task runner and reconnaissance tool.
The Gentlemen threat actor group is utilizing the cross-platform TukTuk C2 framework and BYOVD techniques to neutralize EDR solutions while targeting global technology and healthcare sectors.
Atomic macOS Stealer (AMOS) is being delivered via a sophisticated ClickFix attack chain that uses a deceptive Xcode download site to trick users into executing malicious Terminal commands.
The Iranopasmigirim campaign by an Iran-linked actor uses DLL sideloading to deploy ParsaStealer, a Rust-based infostealer targeting dissidents via lures mimicking the Rise Iran movement.
AvisLoader is a Windows loader using the Tox encrypted peer-to-peer messaging network for command-and-control to evade traditional domain-based takedowns.
A Ukrainian-themed phishing campaign utilizes a multi-stage VBScript dropper to download decoy documents and execute payloads from external file-hosting infrastructure.
Atomic macOS (AMOS) Stealer targets macOS users through social engineering campaigns masquerading as software toolkits, exfiltrating browser data, credentials, and cryptocurrency wallets.
A malicious LNK file disguised as an OIC invitation uses PowerShell to download an archive that installs PlugX via DLL side-loading through a Jarte-derived application.
