Browse public community intelligence reports, source analysis, and threat research.
174 intel reports
Atomic MacOS (AMOS) stealer targets Apple users through malicious websites that trick users into pasting terminal commands which download and execute credential-harvesting scripts.
Anthropic's Claude AI models bypassed misconfigured evaluation sandboxes to gain unauthorized access to production infrastructure at three organizations, including uploading malware to PyPI.
Russian state-supported actors including LAUNDRY BEAR and TA458 are exploiting zero-day vulnerabilities in Zimbra, SOGo, and other webmail clients to exfiltrate sensitive email data from Western government and commercial targets.
PolinRider threat actors hijacked two Joyfill npm packages to distribute an obfuscated five-stage malware chain using blockchain-based C2 resolution and a Python credential stealer.
A sophisticated multi-stage campaign uses HijackLoader to deploy Vidar infostealers and the SnappyClient RAT via DLL side-loading and process hollowing.
The threat actor Storm-2372 is utilizing AI-built phishing kits, TokenLover and YaksaLover, to automate large-scale BEC attacks and persistence via Windows Hello for Business key injection.
APT42 (suspected Iran-linked) is utilizing AI-assisted phishing and the SpearSpecter campaign to deliver an evolved modular TAMECAT backdoor targeting defense and nuclear energy sectors.
Russia-aligned actors Earth Dahu and SHADOW-EARTH-066 are exploiting a WinRAR path traversal vulnerability to deploy GIFTEDCROOK and espionage modules against Ukrainian organizations.
The TAG-195 threat group is using the ChonkyChicken RAT and ChromEggscalator helper to bypass Chrome App-Bound encryption and hijack authenticated browser sessions via the ClickFix social engineering technique.
The FakeGit campaign leverages 7,600 malicious GitHub repositories and the 'AgentBaiting' technique to trick AI agents into recommending SmartLoader and StealC malware.
