Browse public community intelligence reports, source analysis, and threat research.
84 intel reports
Unknown attackers compromised the Rank Math PRO WordPress plugin version 3.0.123 to deploy self-rebuilding backdoors and unauthorized administrator accounts.
The RedDirection campaign weaponized 18 legitimate browser extensions via updates to facilitate traffic redirection, data hijacking, and persistent command-and-control access.
An operator identified as Zaib Ali uses a massive npm typosquatting campaign to discover infrastructure and a custom FastAPI framework called VHX Harvester to hijack GPU resources on the vast.ai marketplace.
Lazarus Group is distributing Graphalgo malware via malicious Terraform providers and Go modules to target infrastructure developers and cryptocurrency assets.
China-nexus threat actors, including Storm-3069, utilize the modular NeedyMantis malware to maintain long-term access in telecommunications, government, and education sectors following initial compromise.
FomoPeek versions 1.1 and 1.2 utilized kernel exploits and sandbox escapes to steal cryptocurrency private keys and sensitive data from iOS devices.
Adversaries such as TeamPCP exploit Python package installation mechanisms including setup.py hooks, .pth files, and entry points to compromise developer environments and CI/CD pipelines.
A North Korean-linked operation targeted the npm registry using the GHAPPIER loader to establish persistence and remote access via compromised developer credentials.
An ongoing malicious npm campaign involving 'indexed-btree' and other packages bypasses lifecycle script defenses by burying loaders in runtime prototype methods and using Ethereum smart contracts for C2.
Mini Shai-Hulud threat actors exploited re-enabled GitHub Actions repositories to resume credential harvesting via compromised mutable tags.
