Browse public community intelligence reports, source analysis, and threat research.
174 intel reports
Varonis Threat Labs identified TrustSink, a post-compromise technique where attackers with high privileges register rogue External Authentication Methods (EAM) in Microsoft Entra to capture plaintext passwords during legitimate MFA flows.
Unknown actors compromised MemTensor packages on npm and PyPI to deliver 'sckit', a Go-based worm designed for credential harvesting and self-propagation via CI/CD pipelines.
Exvicy is an emerging Malware-as-a-Service framework that copycats ErrTraffic, using fake Cloudflare Turnstile challenges to deceive users into executing malicious PowerShell commands via the Win+R shortcut.
A malicious Firefox extension named PDF Identity Verifier uses post-install payload fetching to steal Google session cookies and automate password resets for Portuguese- and Spanish-speaking users.
The RevStealer infostealer uses trojanized Electron applications and blockchain-based C2 failover to target credentials, cryptocurrency wallets, and browser data on Windows systems.
PamStealer targets macOS users via fake 'Wavel' crypto wallet lures, utilizing a novel live server-side decryption utility (pkgunpack) and a Swift-based infostealer payload.
A local attacker can redirect Meta Muse dictation traffic by modifying an undocumented preference setting, enabling the capture of audio and abuse of the assistant's broad permissions.
Chinese threat actors UTA0560 and JungleBamboo exploited a 'patch-gap' zero-day chain in Chrome and Windows to deploy the GRIMWEDGE backdoor and LONGTALE credential stealer.
The Iranopasmigirim campaign by an Iran-linked actor uses DLL sideloading to deploy ParsaStealer, a Rust-based infostealer targeting dissidents via lures mimicking the Rise Iran movement.
The ClickFix campaign compromised a regional news outlet using malicious JavaScript to deliver social engineering prompts that lead to the execution of an encrypted .NET infostealer.
