Browse public community intelligence reports, source analysis, and threat research.
10 intel reports
Attackers can leverage leaked GitLab incoming email tokens to push code, execute CI/CD jobs, and bypass IP restrictions by spoofing merge request emails.
Threat actors are using infostealers like Lumma and Vidar to harvest session tokens and API keys for AI services to bypass MFA and conduct LLMjacking.
Grafana MCP servers were found vulnerable to a critical killchain involving session spoofing and a 9.1 CVSS SSRF vulnerability that allows unauthenticated access to internal infrastructure.
CISA red teams achieved full domain compromise and sensitive system access in two organizations, highlighting risks in cloud identity permissions and Active Directory Certificate Services (ADCS).
Gunra is a Conti-derived ransomware-as-a-service (RaaS) targeting global critical infrastructure using double-extortion and cross-platform encryptors.
The ToddyCat APT group utilizes Umbrij malware to compromise corporate Gmail accounts by leveraging a technique called Shadow Token via Remote Debug (STRD) to steal OAuth tokens.
Vulnerabilities in Microsoft Graph API allow attackers to bypass Conditional Access policies and escalate token privileges to enumerate entire Entra ID tenants using compromised credentials.
Midnight Blizzard leverages compromised Entra ID Agent Blueprints to pivot between tenants and escalate to Global Administrator using Temporary Access Passes.
The AutoJack exploit chain leverages a confused deputy browsing agent to bypass localhost trust boundaries and achieve RCE in Microsoft's AutoGen Studio.
Nation-state actors including Cloaked Ursa and Curious Serpens are weaponizing the ROADtools framework to enumerate Entra ID environments and maintain persistence through rogue device registration.
