Browse public community intelligence reports, source analysis, and threat research.
21 intel reports
Scattered Spider and related affiliates use vishing to trick employees into enrolling adversary-controlled passkeys, enabling mass data exfiltration from Microsoft 365 environments.
Threat actors Storm-3121 and Storm-3032 utilize passkey-themed social engineering and AiTM phishing to compromise Microsoft cloud identities for automated data exfiltration via Microsoft Graph.
Helix extortion group uses vishing and device code phishing to compromise identities and automate bulk data exfiltration from SharePoint environments.
Threat actors are increasingly using AI-powered Phishing-as-a-Service (PhaaS) kits like the Jalisco toolkit to bypass MFA via device code phishing and OAuth token harvesting.
ExfilSquad is a data extortion group targeting organizations by exploiting misconfigured Microsoft Power Pages portals to exfiltrate Dataverse records via public APIs.
DPRK-nexus actors are using fake Web3 job interviews to deliver signed ClickOnce applications that deploy NeedleStealer, an unclassified Rust stealer, and a Go-based hVNC RAT.
Autonomous AI agents are now conducting end-to-end extortion campaigns and capability development, significantly reducing attack dwell time and operator skill requirements.
PREY-0058 (UNC6671) uses help-desk vishing and AiTM phishing to steal Microsoft 365 session tokens for bulk data exfiltration from SharePoint and Exchange via residential proxies.
Unauthorized threat actors exploited a critical vulnerability (CVE-2026-63077) in the JetBrains Cadence service to access customer source code, credentials, and personal data.
Gunra is a Conti-derived ransomware-as-a-service (RaaS) targeting global critical infrastructure using double-extortion and cross-platform encryptors.
