Browse public community intelligence reports, source analysis, and threat research.
39 intel reports
ACR Stealer (formerly Amatera Stealer) employs ClickFix social engineering, WebDAV delivery, and steganography to steal browser credentials and sensitive documents from Windows and macOS environments.
The China-linked threat actor Silver Fox (UTG-Q-1000) is utilizing SEO poisoning and counterfeit installers to deliver a modular Rust-based RAT called MODBEACON featuring gRPC-encrypted communications.
A financially motivated campaign by the X3D MINER group uses the Factory-v3 loader framework to deliver Vidar stealer and XMRig miner through malvertising and fake software cracks.
Detection opportunities and rules for TAG-182's MarkiRAT campaign, covering fake VPN/media-player lures, BITS job abuse, svehost.exe masquerading, and typosquatted C2 infrastructure impersonating maj…
State-sponsored and cybercriminal actors are utilizing ClickFix Payload-as-a-Service (CPaaS) to deliver dynamically obfuscated malware via fake CAPTCHA social engineering and stealthy clipboard injection.
Researchers discovered a critical zero-click vulnerability in Opera GX's mod installation pipeline that allows malicious sites to perform universal CSS injection and steal sensitive data via XS-Leaks.
The ToddyCat APT group utilizes Umbrij malware to compromise corporate Gmail accounts by leveraging a technique called Shadow Token via Remote Debug (STRD) to steal OAuth tokens.
Initial Access Broker Woodgnat (KongTuke) is deploying the Mistic and MLTBackdoor RATs via social engineering and compromised WordPress sites to sell network access to major ransomware affiliates.
JanelaRAT is an evolving variant of BX RAT targeting financial and cryptocurrency institutions in Latin America through DLL side-loading and sophisticated overlay attacks.
