Browse public community intelligence reports, source analysis, and threat research.
84 intel reports
The ChocoPoC threat actor is targeting security researchers with trojanized GitHub PoC repositories that install malicious PyPI packages to deliver a Python-based RAT.
Lazarus group deployed a cluster of malicious npm packages masquerading as Rollup polyfill tools to target developer workstations with a multi-stage remote access and data-stealing payload.
TeamPCP and related campaigns are targeting GitHub Actions CI runners using malware like Megalodon and Miasma to harvest credentials and persist within development pipelines.
The Trum3it campaign utilizes a fake Polymarket arbitrage bot and 42 malicious npm packages to deliver an infostealer targeting DeFi developer credentials and crypto wallets.
Lazarus-linked North Korean actors are targeting software developers via hijacked npm/Go packages and fraudulent job interviews to deploy the InvisibleFerret infostealer.
The Miasma worm campaign compromised 20 LeoPlatform npm packages and a Verana Blockchain Go module to deploy a Bun-based credential stealer targeting developer environments and CI/CD pipelines.
Initial Access Broker Woodgnat (KongTuke) is deploying the Mistic and MLTBackdoor RATs via social engineering and compromised WordPress sites to sell network access to major ransomware affiliates.
A critical heap out-of-bounds write vulnerability in FFmpeg's MagicYUV decoder (CVE-2026-8461) allows remote code execution via crafted media files targeting media servers and thumbnail generators.
The Mastra AI framework suffered a supply chain attack involving over 140 compromised npm packages that deliver a cross-platform infostealer via a typosquatted dependency.
The GLASSWORM threat actor is deploying trojanized Open VSX extensions using TinyGo-compiled WebAssembly loaders that leverage Solana blockchain memos for C2 infrastructure resolution.
