Browse public community intelligence reports, source analysis, and threat research.
43 intel reports
The Offside Wallet Theft Factory campaign utilizes 77 malicious Firefox extensions to steal cryptocurrency secrets and credentials by masquerading as Web3 tools and sports-score utilities.
China-based Jewelbug APT utilizes the XG-Web platform to conduct dual-mission operations involving government espionage across the Middle East and Asia alongside large-scale cryptocurrency fraud.
China-based APT Jewelbug conducts simultaneous government espionage across the Middle East and Asia alongside industrial-scale cryptocurrency fraud using a unified C2 framework.
Myxa VPN operates 737 malicious Chrome extensions impersonating 66 privacy brands to redirect all user browser traffic through controlled SOCKS5 proxies.
UNC6692 uses email bombing and IT impersonation via Microsoft Teams to deploy the Edgecution/SNOW malware suite and facilitate ransomware access.
The XCSSET malware family has evolved to version 40, employing advanced in-memory execution, polymorphic payloads, and supply chain infection via poisoned Xcode projects targeting macOS developers.
Threat actors are using Google Search Ads to deliver SilentMare and HollowMare malware via trojanized utility applications like PDF converters and ZIP tools.
The Chaos ransomware group is using a new Rust-based RAT called msaRAT that establishes covert C2 channels by hijacking headless Chrome and Edge browsers via the Chrome DevTools Protocol.
BlueNoroff is utilizing an advanced phishing kit to impersonate Zoom and Microsoft Teams, profiling cryptocurrency wallets before delivering tailored malware to high-value targets.
A vulnerability in Anthropic's Claude for Chrome browser extension allows malicious extensions to trigger sensitive AI workflows by simulating untrusted user clicks.
