Browse public community intelligence reports, source analysis, and threat research.
88 intel reports
The North Korean-linked threat actor Larva-26005 is targeting South Korean users by distributing the Xctdoor and XcLoader backdoors through spear phishing and installers disguised as legitimate security programs.
Security researcher Chaotic Eclipse released a Windows Zero-Day PoC, LegacyHive, which enables arbitrary registry hive loading for privilege escalation across all supported Windows versions.
A sophisticated macOS ClickFix campaign is now using server-side browser-fingerprinting gates to deliver infostealers like AMOS and MacSync only to genuine macOS environments.
An unidentified threat actor leveraged SQL injection on a Tomcat application to install a database-resident post-exploitation toolkit called khunt on an Oracle server.
Threat actors are deploying the NetSupport Manager RAT through a multi-stage chain involving phishing PDFs and obfuscated JavaScript to disguise legitimate binaries in a 'Stereo' folder.
A sophisticated multi-stage campaign uses HijackLoader to deploy Vidar infostealers and the SnappyClient RAT via DLL side-loading and process hollowing.
JadeProx is a China-nexus threat cluster targeting Southeast Asia and Latin America using TriBack Loader and various tunneling tools for cyber espionage.
The Astaroth (Guildma) banking trojan has integrated a new browser-automated WhatsApp Web spambot to propagate malware through trusted social contacts, primarily targeting Brazilian users.
EtherHiding malware on macOS uses Polygon smart contracts as dead-drop resolvers for C2 domain rotation to evade traditional sinkholing and detection.
TAG-195 (Golden Chickens) has introduced a new generation of modular malware, including TinyEgg and ChonkyChicken, featuring enhanced browser credential theft and session automation via CDP.
