Browse public community intelligence reports, source analysis, and threat research.
39 intel reports
The GlowComa threat actor is distributing ICMacOS, a macOS-targeted Malware-as-a-Service that has evolved from an information stealer into a persistent Remote Access Trojan (RAT).
Adversaries leverage ClickFix social engineering, ClearFake etherhiding, and SNEAKY2FA AiTM phishing to deliver malware and hijack sessions.
Lumma Stealer is a Malware-as-a-Service infostealer targeting sensitive data via social engineering techniques like ClickFix and deceptive PowerShell execution.
Unattributed threat actors are leveraging legitimate MSP360 RMM and ConnectWise ScreenConnect installers via phishing to establish persistent remote access and deploy post-compromise tools.
2CLoader is a sophisticated new malware loader identified in August 2026 that uses indirect system calls and environment spoofing to deliver information stealers like Vidar and Remus.
SilverFox actors are targeting Malaysian users via WhatsApp lures that deliver ValleyRAT using DLL side-loading of a signed KuGou Technology executable.
Sauron Loader is a novel Russian-language Malware-as-a-Service that utilizes social engineering, DLL side-loading, and in-memory decryption to deliver multi-stage payloads.
Threat actors are utilizing a Black Basta-style playbook involving email bombing and Microsoft Teams vishing to deliver Xray-core implants via DLL sideloading.
Iranian state cyber actors are using CHOSEN BRICK, a Windows-based spyware, to monitor dissidents and activists through social engineering and Telegram-based command and control.
Konni, a DPRK-nexus actor, is targeting Ukrainian entities using socio-economic lures to deploy VelvetCake, a modular PowerShell-based task runner and reconnaissance tool.
