Browse public community intelligence reports, source analysis, and threat research.
43 intel reports
The bonto.io campaign uses malicious Firefox extensions impersonating Phantom, Jupiter, and Bitget wallets to steal recovery phrases and private keys.
The RedDirection campaign weaponized 18 legitimate browser extensions via updates to facilitate traffic redirection, data hijacking, and persistent command-and-control access.
Two malicious Chrome extensions totaling 900,000 users are exfiltrating AI chat conversations and browsing history to attacker-controlled C2 servers.
A coordinated campaign of 16 malicious Firefox extensions masquerades as Rabby and OKX wallets to intercept and exfiltrate recovery phrases and private keys.
The Poper Blocker browser extension by dingosolutions acts as spyware by using a custom remote interpreter to exfiltrate browsing history, AI chat logs, and screenshots.
An intrusion campaign utilizing SEO poisoning delivers PavokwiLoader and RMMCRAT, employing advanced obfuscation and environment gating to deploy Cobalt Strike beacons.
The Russian-aligned Lunex Malware-as-a-Service platform utilizes a complex four-stage attack chain, including BYOVD-based EDR neutralization, to deploy a sophisticated information stealer and C2 agent.
A malicious Firefox extension named PDF Identity Verifier uses post-install payload fetching to steal Google session cookies and automate password resets for Portuguese- and Spanish-speaking users.
Chinese threat actors UTA0560 and JungleBamboo exploited a 'patch-gap' zero-day chain in Chrome and Windows to deploy the GRIMWEDGE backdoor and LONGTALE credential stealer.
The REF9334 threat group utilizes the KREMLIN toolkit to install malicious browser extensions on Chrome and Edge, leveraging Ethereum smart contracts as dead-drop resolvers to target Brazilian banking users.
