Browse public community intelligence reports, source analysis, and threat research.
39 intel reports
Threat actors registered the common documentation placeholder third-party[.]com to serve ClickFix social engineering lures that trick Windows users into executing malicious PowerShell commands.
The SideCopy APT is targeting Indian academic institutions using weaponized LNK files and mshta.exe to deploy ReverseRAT via fileless .NET deserialization.
Atomic macOS (AMOS) Stealer targets macOS users through social engineering campaigns masquerading as software toolkits, exfiltrating browser data, credentials, and cryptocurrency wallets.
The REF9334 threat group utilizes the KREMLIN toolkit to install malicious browser extensions on Chrome and Edge, leveraging Ethereum smart contracts as dead-drop resolvers to target Brazilian banking users.
CISA red teams achieved full domain compromise and sensitive system access in two organizations, highlighting risks in cloud identity permissions and Active Directory Certificate Services (ADCS).
Threat actors including APT29 and North Korean-linked campaigns are increasingly misusing trusted collaboration platforms like Slack and Microsoft Teams for identity phishing, credential theft, and persistence.
The Offside Wallet Theft Factory campaign utilizes 77 malicious Firefox extensions to steal cryptocurrency secrets and credentials by masquerading as Web3 tools and sports-score utilities.
Storm-2755 (Payroll Pirates) uses AiTM phishing and residential proxies to compromise Microsoft 365 accounts for financial data theft and payroll diversion.
Attackers are impersonating Interactive Brokers using a tax-themed W-8BEN expiration lure and 0-day domains to harvest credentials from healthcare sector employees.
TAG-195 (Golden Chickens) has introduced a new generation of modular malware, including TinyEgg and ChonkyChicken, featuring enhanced browser credential theft and session automation via CDP.
