Browse public community intelligence reports, source analysis, and threat research.
84 intel reports
The threat actor TeamPCP compromised the popular litellm PyPI library to distribute a multi-stage credential harvester and Kubernetes lateral movement payload.
Threat actor TeamPCP compromised the Trivy vulnerability scanner and associated GitHub Actions to exfiltrate cloud and CI/CD credentials via poisoned tags and binaries.
An ongoing campaign, dubbed ForceMemo, compromises developer GitHub accounts to inject malware into Python repositories using a stealthy force-push technique and a Solana-based C2.
The threat actor TeamPCP compromised Aqua Security's Trivy project, injecting credential-stealing malware into official releases and forcing malicious updates to GitHub Actions.
