Browse public community intelligence reports, source analysis, and threat research.
43 intel reports
Researchers at Forever Security demonstrated 'BragJack', a technique using malicious browser extensions to hijack AI assistants in Chrome, Edge, Comet, Opera Neon, and Claude by manipulating trusted domains and network traffic.
Multiple espionage threat actors, including China-aligned TA412, are deploying the BlueMoon exploit kit to chain Chrome V8 RCE and Windows kernel LPE vulnerabilities for malware delivery.
The JeetBot browser extension exfiltrates Twitch OAuth tokens to Russian proxy infrastructure, affecting over 31,000 users.
Threat actors are using infostealers like Lumma and Vidar to harvest session tokens and API keys for AI services to bypass MFA and conduct LLMjacking.
A Chinese-speaking operator uses the PEEP toolkit, a RedExt derivative, to transform Chromium browsers into persistent host-level backdoors via native-messaging bridges.
The CL-CRI-1171 threat actor operates a mature Pay-Per-Install (PPI) marketplace that leverages SEO poisoning and trojanized YouTube gaming content to distribute OfferLoader and a variety of secondary payloads including Insomnia RAT and ARKTunnel.
The WEEVILPROXY threat actor is deploying JSCeal, a compiled V8 JavaScript malware that uses stolen session cookies to bypass Google authentication and target cryptocurrency investors.
The suspected APT29 group (Cloaked Ursa) launched the Spring Ring campaign targeting over 150 employees with Microsoft Teams-based voice phishing to deploy RMM tools and custom PowerShell RATs.
The Superior threat actor uses 19 malicious Chrome and Edge extensions to deliver wallet drainers and credential-stealing payloads through a modular JavaScript framework.
Kimsuky targets South Korea and Japan using spear phishing to deploy LNK malware and abuse legitimate remote access tools like AnyDesk and Chrome Remote Desktop.
