Browse public community intelligence reports, source analysis, and threat research.
64 intel reports
A ClickFix campaign utilizes EtherHiding via BSC testnet contracts to deliver multi-stage PowerShell loaders that inject shellcode into MicrosoftEdgeUpdate.exe.
SkyW4lker is a device-code phishing kit targeting Microsoft 365 users, primarily in the US technology and manufacturing sectors, to bypass MFA and obtain access tokens.
The XWorm 6.0 modular malware has resurfaced with over 35 plugins for data theft, ransomware, and persistence, primarily targeting Windows systems via phishing and malicious installers.
China-based threat actors are deploying RatHat, a sophisticated Android Trojan that leverages generative AI for UI automation and ADB self-pairing for persistent shell access.
The CSuite operation targets US and European organizations using sophisticated phishing lures to steal Microsoft 365 sessions and deploy legitimate RMM tools like ScreenConnect for persistent endpoint access.
An intrusion campaign utilizing SEO poisoning delivers PavokwiLoader and RMMCRAT, employing advanced obfuscation and environment gating to deploy Cobalt Strike beacons.
VK Group’s Max messenger facilitates state-level surveillance by providing unencrypted message access, mandatory pre-installation, and granular behavioral tracking of Russian users.
MovieReaper uses compromised torrent repositories and the Solana blockchain to deploy a multi-stage modular framework targeting diverse global sectors.
GhostCode is a novel phishing kit that abuses the Microsoft Device Code authorization flow to bypass MFA and achieve persistent access to M365 environments.
The REF9334 threat group utilizes the KREMLIN toolkit to install malicious browser extensions on Chrome and Edge, leveraging Ethereum smart contracts as dead-drop resolvers to target Brazilian banking users.
