Browse public community intelligence reports, source analysis, and threat research.
174 intel reports
Aeza Group infrastructure is being used to deploy Go-based Mach-O malware through ClickFix social engineering, targeting macOS users to steal credentials and drain cryptocurrency wallets.
UNC6671 and associated clusters utilize sophisticated vishing and AiTM panels to harvest credentials and exfiltrate data from enterprise cloud and financial platforms.
Cybercriminals are stealing AI API tokens using supply chain attacks and infostealers to fuel gray-market 'transfer station' proxy services, causing massive financial losses.
Security researcher Gareth Heyes demonstrates how to bypass CSS sanitizers in major webmail clients to perform real-time keylogging, token theft, and UI defacement.
A sophisticated macOS ClickFix campaign is now using server-side browser-fingerprinting gates to deliver infostealers like AMOS and MacSync only to genuine macOS environments.
Storm-2945 utilizes a macOS ClickFix social engineering campaign to deliver Atomic Stealer and MacSync malware through sophisticated server-side browser-fingerprinting gates.
Midnight Blizzard sub-cluster Storm-2945 is conducting the CaptiveCrunch campaign, leveraging traffic manipulation in hospitality networks to deliver custom Go and PowerShell malware and conduct device code phishing.
Storm-2945, a sub-cluster of Midnight Blizzard (APT29), is hijacking hospitality Wi-Fi networks to deliver CornFlake RAT and ChocoShell infostealer via DNS poisoning and fake update prompts.
Threat actors are utilizing fake software updates and gaming cheats to deploy ScreenConnect RMM agents and the Powercat Java stealer for persistent access and credential theft.
North Korean threat actors compromised two @joyfill npm packages to deliver the DEV#POPPER RAT and OmniStealer via a multi-chain blockchain C2 infrastructure.
