Browse public community intelligence reports, source analysis, and threat research.
88 intel reports
The Shai-Hulud worm compromised the tensorlake npm package to exfiltrate secrets and cryptocurrency browser data while implementing a destructive 'dead-man's switch' upon token revocation.
Threat actors compromised LiteLLM's CI/CD pipeline by exploiting leaked GitHub CLI tokens in logs to distribute a malicious Python package containing the privcollect stealer and a RAT.
The ROMULUS delivery platform utilizes ClickFix lures and social engineering to distribute diverse payloads including LegionLoader, Atlas RAT, and RomulusLoader targeting global organizations.
A ClickFix campaign utilizes EtherHiding via BSC testnet contracts to deliver multi-stage PowerShell loaders that inject shellcode into MicrosoftEdgeUpdate.exe.
KGB RAT is a Windows-based Malware-as-a-Service (MaaS) tool providing Remote Access Trojan capabilities, including credential theft, HVNC, ransomware, and cryptocurrency wallet swapping.
The bonto.io campaign uses malicious Firefox extensions impersonating Phantom, Jupiter, and Bitget wallets to steal recovery phrases and private keys.
Glassworm threat actors compromised a contributor's GitHub account to replace official OVHcloud CLI release binaries with secret-stealing malware using a Solana-based dead drop for command and control.
The Ebury botnet hijacked over 300 Tor exit relays to perform Man-in-the-Middle (MitM) attacks on SSH traffic, capturing login credentials and installing further malware.
UNC7017 conducted ephemeral supply chain tampering against AOMEI Technology update servers to deliver CROSSROAD and SHINYROAD malware via short-burst configuration modifications.
The Ebury botnet hijacked 377 Tor exit relays to intercept SSH connections, steal passwords, and redirect encrypted mail traffic to plaintext ports.
