Browse public community intelligence reports, source analysis, and threat research.
174 intel reports
The Storm-1747 threat actor uses the Tycoon 2FA AiTM phishing kit to bypass multi-factor authentication and maintain persistence in Microsoft 365 and Google Workspace environments.
North Korea-aligned actors are targeting developers via phishing and malicious GitHub repositories using VS Code's 'runOn' features to deliver cross-platform malware.
KongTuke and PS1Bot campaigns leverage malicious browser extensions and malvertising to deliver modular RATs and information stealers targeting Windows and macOS systems.
Team PCP's Miasma toolkit automates software supply chain attacks by poisoning package registries, hijacking GitHub Actions, and injecting malicious configurations into AI coding agents.
Storm-1747 utilizes Tycoon 2FA to bypass MFA and maintain persistence through device registration and session token theft targeting Microsoft and Google cloud environments.
Threat actor EvilTokens uses device code flow phishing to bypass MFA and obtain Primary Refresh Tokens for persistent Microsoft 365 access.
The EvilTokens Phishing-as-a-Service leverages Microsoft device code authentication flows and AI-driven automation to exfiltrate tokens and orchestrate large-scale Business Email Compromise (BEC) attacks.
A vulnerability in Hugging Face Transformers allows attackers to execute arbitrary Python code via crafted config.json files in model repositories, bypassing the trust_remote_code protection.
Hannibal Stealer is a sophisticated .NET-based information harvester and cryptocurrency stealer that utilizes DLL injection, Telegram-based C2, and clipboard hijacking to target browser data, VPN configurations, and crypto wallets.
A new threat actor is deploying clones of the Shai-Hulud infostealer and the Phantom Bot DDoS malware via typosquatted npm packages targeting developers.
