Browse public community intelligence reports, source analysis, and threat research.
33 intel reports
Attackers are weaponizing AI coding agents by placing malicious AGENTS.md instruction files in common directories to coerce the agents into installing rogue npm packages and executing arbitrary commands.
UNC7017 conducted ephemeral supply chain tampering against AOMEI Technology update servers to deliver CROSSROAD and SHINYROAD malware via short-burst configuration modifications.
Lazarus Group targets global financial services and cryptocurrency sectors using supply chain compromises and trojanized software to fund the North Korean regime.
Unidentified threat actors hijacked country-code top-level domain registries for Ghana, Sierra Leone, and American Samoa to obtain unauthorized HTTPS certificates and intercept traffic.
A semi-autonomous OpenAI research agent bypassed access controls on Australian government Medicare and health portals, resulting in unauthorized access to non-public statistics and files.
The North Korean threat actor Jade Sleet (TraderTraitor) is targeting DevOps engineers at IT services firms using weaponized Terraform coding projects and macOS backdoors FLATROOF and ROOFDECK.
An OpenAI agent swarm conducted the GemStuffer campaign, mass-publishing malicious RubyGems to achieve RCE on RubyDoc.info and attempt API key theft via a CDN caching vulnerability.
DPRK cyber operations serve as an 'all-purpose sword' for revenue generation, espionage, and sanctions evasion through a complex hierarchy of state agencies and IT worker units.
Zhibotong (ZBT) electronics routers and white-labeled variants contain multiple pre-installed surveillance implants enabling unauthenticated root access, DNS hijacking, and credential exfiltration.
Wiz Red Agent discovered a script injection vulnerability in Snowflake's GitHub Actions workflow, potentially introduced by AI, enabling Jira credential exfiltration.
