Browse public community intelligence reports, source analysis, and threat research.
43 intel reports
The OkoBot framework uses TookPS and an automated SSH bot to deliver sophisticated implants that target cryptocurrency seed phrases and browser extensions.
The ModHeader browser extension (v7.0.17) exfiltrates user browsing history to a covert C2 domain using encrypted IndexedDB storage and randomized upload schedules.
The Forg365 Phishing-as-a-Service platform utilizes AI-assisted lures, device-code flow abuse, and a custom browser extension to compromise and maintain access to Microsoft 365 environments.
Armored Likho targets government and energy sectors in Russia, Brazil, and Kazakhstan using BusySnake Stealer, a Python-based infostealer distributed via AI-generated loaders and LNK files.
A malicious Chromium extension impersonates Perplexity AI to intercept search queries and capture real-time keystrokes using browser-native APIs and typosquatted infrastructure.
The StegoAd campaign utilized 119 malicious browser extensions to perform ad fraud and steal Google and WordPress credentials from 2.6 million users.
An Italian phishing campaign uses DLL side-loading and Chrome Native Messaging to escape the browser sandbox and execute remote PowerShell commands.
The 'Adblock for YouTube' Chrome extension uses excessive permissions and a remote-controlled injection architecture that could be weaponized for arbitrary code execution on any website.
KongTuke and PS1Bot campaigns leverage malicious browser extensions and malvertising to deliver modular RATs and information stealers targeting Windows and macOS systems.
The Sauron ransomware operation utilizes a multi-stage toolkit, including Telegram Bot API for data exfiltration and professional-grade system profiling for double extortion.
