Browse public community intelligence reports, source analysis, and threat research.
38 intel reports
APT28 (Swallowtail) is executing a complex cyber espionage campaign targeting NATO naval and aerospace manufacturers using the Hookedge backdoor and a novel reflective loader.
SkyW4lker is a device-code phishing kit targeting Microsoft 365 users, primarily in the US technology and manufacturing sectors, to bypass MFA and obtain access tokens.
The Kimsuky threat group is utilizing malicious Hangul (HWP) resume documents to deploy Quasar RAT and ultimately the Funhouse ransomware variant.
The STAC4924 campaign, linked to GOLD VICTOR (Vice Society), uses TerminalFix lures to deploy Lorem Ipsum Loader and custom Python tunneling implants via DLL sideloading.
An attacker-controlled ScreenConnect client is being distributed via phishing emails as a legitimate, signed executable to gain remote access to victim systems.
Russian-branded ClickFix campaigns are compromising Ukrainian websites to deliver the Psychedelic infostealer and persistent remote access tools using fake CAPTCHA lures.
Adversary Pursuit Group identified ChainScript, a Node.js RAT that utilizes Polygon smart contracts for resilient C2 infrastructure rotation and delivery via ClickFix lures.
Exvicy is an emerging Malware-as-a-Service framework that copycats ErrTraffic, using fake Cloudflare Turnstile challenges to deceive users into executing malicious PowerShell commands via the Win+R shortcut.
The Phexia threat actor uses fake CAPTCHA 'ClickFix' lures to deploy a macOS backdoor that resolves its C2 hostname via a Polygon smart contract and drops multiple infostealers.
Researchers at pwn.ai discovered the Click2Shell attack chain, which leverages a WordPress core selector injection vulnerability to force theme installations and achieve remote code execution through theme-specific flaws.
