Browse public community intelligence reports, source analysis, and threat research.
64 intel reports
The Russia-linked Turla group is deploying STOCKSTAY, a multi-component .NET backdoor masquerading as benign utilities, to target government and military entities in Ukraine and Europe.
Bluekit PhaaS leverages advanced Browser-in-the-Middle (BitM) techniques and AI to bypass MFA by streaming live DOM interactions to victims.
Threat actor abdrizak uses typosquatted npm packages like postcss-minify-selector-parser to deliver a multi-stage Windows RAT targeting developer environments.
A cryptocurrency-mining campaign exploits CVE-2026-33017, an unauthenticated RCE in Langflow, to deploy a Go-based miner with aggressive defense evasion and lateral movement capabilities.
SilverFox actors are utilizing a multi-stage loader chain masquerading as Panasonic and Philips software to deploy Sauron/Gh0stRAT backdoors via Alibaba OSS infrastructure.
An actor published 15 npm packages using 13 throwaway scopes to deliver a multi-stage Rust-compiled infostealer targeting developer and crypto credentials.
Rapid Brigantine has pivoted to ClickFix lures on compromised WordPress sites to deploy the Lorem Ipsum Loader following a disruption to their previous malware-signing infrastructure.
An attacker compromised the CDN API keys of OptinMonster, TrustPulse, and PushEngage to serve tampered JavaScript that creates rogue admin accounts on customer sites.
Kimsuky APT utilizes a multi-stage JScript loader to deploy the NUKESPED backdoor, targeting South Korean entities through social engineering lures.
BQTLock ransomware utilizes a multi-stage PyInstaller-packed architecture, leveraging Remcos RAT for initial access and Discord/Telegram for covert command-and-control.
