Browse public community intelligence reports, source analysis, and threat research.
128 intel reports
Storm-2945 utilizes a macOS ClickFix social engineering campaign to deliver Atomic Stealer and MacSync malware through sophisticated server-side browser-fingerprinting gates.
Attackers are using cloned greeting-card templates with globally rewritten anchors to deliver ScreenConnect remote-access installers targeting healthcare data-protection roles.
Nebula Security researchers disclosed IonStack, an exploit chain combining a Firefox JIT miscompilation (CVE-2026-10702) and a 15-year-old Linux kernel futex flaw (CVE-2026-43499) to achieve remote code execution and root privileges.
JadeProx is a China-nexus threat cluster targeting Southeast Asia and Latin America using TriBack Loader and various tunneling tools for cyber espionage.
Russia-aligned actors Earth Dahu and SHADOW-EARTH-066 are exploiting a WinRAR path traversal vulnerability to deploy GIFTEDCROOK and espionage modules against Ukrainian organizations.
The FakeGit campaign leverages 7,600 malicious GitHub repositories and the 'AgentBaiting' technique to trick AI agents into recommending SmartLoader and StealC malware.
BlueNoroff is utilizing an advanced phishing kit to impersonate Zoom and Microsoft Teams, profiling cryptocurrency wallets before delivering tailored malware to high-value targets.
The PhantomEnigma campaign leverages compromised Brazilian .gov.br infrastructure to deliver a modular Node.js backdoor aimed at banking credential theft.
The JadeProx cluster, a China-nexus threat group, is using a custom 'TriBack Loader' to deliver AdaptixC2 and Beagle backdoors via DLL sideloading against targets in Southeast Asia and Latin America.
Anonymous researcher 'bikini' released Exploitarium, a repository containing over 30 proof-of-concept exploits for unpatched vulnerabilities across multiple software projects, including critical flaws in libssh2 and Gitea.
