Browse public community intelligence reports, source analysis, and threat research.
173 intel reports
Suspected state-sponsored actors and cybercriminals, including Midnight Blizzard and ShinyHunters, are utilizing generative AI frameworks like PentAGI to automate the cyber kill chain, reconnaissance, and malware development against global targets.
State-aligned threat actors, primarily China-linked, are deploying the BlueMoon exploit kit to leverage Chrome and Windows zero-days for rapid espionage campaigns.
PREY-0058 (UNC6671) uses help-desk vishing and AiTM phishing to steal Microsoft 365 session tokens for bulk data exfiltration from SharePoint and Exchange via residential proxies.
Threat actors are using infostealers like Lumma and Vidar to harvest session tokens and API keys for AI services to bypass MFA and conduct LLMjacking.
The threat actor 'General Boss' operates BigBear 2.0, an Evilginx2-based Phishing-as-a-Service framework targeting Microsoft 365 accounts globally using AiTM techniques to bypass MFA.
StyleSmuggler is an unauthenticated zero-day RCE vulnerability in Magento and Adobe Commerce being exploited to deploy persistent Rust-based implants and backdoors.
REVSTEALER is a comprehensive Windows infostealer using Polygon smart contracts for resilient C2 infrastructure and delivering specialized modules for crypto-mining and reverse proxying.
Threat actors are increasingly using infostealers like Lumma and Vidar to harvest session tokens and API keys for AI services to bypass MFA and hijack high-cost compute resources.
Suspected Silver Fox actors are targeting Latin American banking and financial sectors using fake DocuSign and NFe tax lures to deliver a custom HVNC backdoor for persistent remote control.
LiteLLM vulnerabilities (CVE-2026-59821, CVE-2026-59822) enable unauthenticated attackers to bypass security controls, achieve root-level RCE, and exfiltrate cloud IAM credentials.
