Browse public community intelligence reports, source analysis, and threat research.
33 intel reports
The North Korean-linked PolinRider campaign has expanded its supply chain targeting across npm, Packagist, Go modules, and Chrome extensions to deploy the DEV#POPPER and OmniStealer malware.
The Russia-aligned Gamaredon group significantly updated its arsenal in 2025, deploying six new PowerShell tools and leveraging legitimate cloud services and tunnels to target Ukrainian military and government institutions.
The Miasma worm campaign compromised 20 LeoPlatform npm packages and a Verana Blockchain Go module to deploy a Bun-based credential stealer targeting developer environments and CI/CD pipelines.
Researchers from AIR created a fake AI agent skill named brand-landingpage that bypassed multiple security scanners to reach 26,000 agents by hosting malicious instructions on an external domain.
Threat actors are weaponizing the OpenClaw AI agent ecosystem by publishing malicious skills on ClawHub that deliver infostealers and execute novel agentic financial fraud.
An unrelated third-party ad operator has re-registered the expired MaxCDN domain netdna-ssl.com, creating a massive supply chain risk for thousands of sites still referencing its legacy infrastructure.
An attacker compromised the CDN API keys of OptinMonster, TrustPulse, and PushEngage to serve tampered JavaScript that creates rogue admin accounts on customer sites.
A vulnerability in Hugging Face Transformers allows attackers to execute arbitrary Python code via crafted config.json files in model repositories, bypassing the trust_remote_code protection.
LAPSUS$ and TeamPCP targeted Checkmarx developer artifacts and GitHub repositories to exfiltrate credentials and distribute malicious plugins via the Jenkins Marketplace and OpenVSX registry.
The Mini Shai-Hulud malware targets SAP npm packages to steal developer and cloud credentials using an obfuscated Bun-based execution framework.
