Browse public community intelligence reports, source analysis, and threat research.
84 intel reports
An attacker compromised the CDN API keys of OptinMonster, TrustPulse, and PushEngage to serve tampered JavaScript that creates rogue admin accounts on customer sites.
A chain of three vulnerabilities in the LiteLLM AI gateway allows low-privilege users to bypass authorization, escalate to administrative privileges, and execute arbitrary code on the host server.
Suspected Lazarus Group (DPRK) operators are using malicious VS Code extensions like jupyter-powerdev to deliver a multi-stage backdoor utilizing SharePoint for C2 and Roslyn for in-memory execution.
OceanLotus (APT32) is leveraging SPECTRALVIPER in targeted supply-chain attacks against Vietnamese stock investors and infrastructure corporations to support domestic surveillance.
TeamPCP uses the Miasma worm to compromise developers and CI/CD pipelines by hijacking AI coding agents and poisoning package registries.
A threat actor operating as Leda Elacoate is conducting a supply chain campaign using trojanized installers for crypto-trading and VPN software to deploy the STX RAT infostealer via DLL sideloading.
The Miasma threat actor group has expanded its supply chain campaign with 23 new malicious PyPI packages targeting bioinformatics and AI developers through trojanized native extensions and split-payload loaders.
A new threat actor is deploying clones of the Shai-Hulud infostealer and the Phantom Bot DDoS malware via typosquatted npm packages targeting developers.
A highly sophisticated multi-stage npm supply chain campaign targeting Red Hat and AI-related packages uses GitHub as an adaptive C2 to deploy the Shai-Hulud infostealer variant 'Miasma'.
TeamPCP and other actors are leveraging container escapes via host vulnerabilities (CVE-2024-21626) and misconfigured orchestration APIs to compromise Kubernetes secrets and host systems.
