Browse public community intelligence reports, source analysis, and threat research.
47 intel reports
Russian-speaking threat actors are exploiting CVE-2026-35616 in FortiClient EMS to deploy EKZ Stealer and FortigateSniffer, facilitating credential harvesting and subsequent ransomware attacks by INC Ransom and Lynx.
A threat actor compromised a Mastra maintainer account to poison 140+ npm packages with a malicious dependency used for cross-platform backdoors and credential exfiltration.
ToddyCat APT uses the Umbrij tool to automate OAuth token theft from Chromium-based browsers via remote debugging ports to access victim Gmail accounts.
Analysis of six bypass techniques targeting the Windows Anti-Malware Scan Interface (AMSI) in PowerShell 5.1 and 7 using reflection, memory patching, and IL emission.
An attacker compromised the CDN API keys of OptinMonster, TrustPulse, and PushEngage to serve tampered JavaScript that creates rogue admin accounts on customer sites.
A sophisticated multi-stage batch dropper uses PowerShell and VBScript to execute obfuscated payloads, perform DLL hijacking, and establish redundant C2 communications.
An unprivileged FreeBSD user can achieve local root access by exploiting a page-cache corruption vulnerability via kTLS-RX and the sendfile(2) system call.
FAMOUS CHOLLIMA (DPRK) distributes the MicrosoftSystem64 RAT via malicious npm packages, leveraging HuggingFace for binary updates and data exfiltration.
Threat actor SheldIO is deploying Amatera Stealer 4.0.2 via the EVALUSION campaign, featuring advanced evasion techniques and significantly expanded targeting for cryptocurrency wallets and messaging apps.
A Chinese-speaking threat actor compromised DAEMON Tools installers to deploy information collectors, minimalistic backdoors, and the complex QUIC RAT against targeted organizations.
