Browse public community intelligence reports, source analysis, and threat research.
12 intel reports
Adversaries leverage ClickFix social engineering, ClearFake etherhiding, and SNEAKY2FA AiTM phishing to deliver malware and hijack sessions.
An unauthenticated attacker can achieve remote code execution on Rejetto HFS by exploiting a predictable PRNG to forge administrator sessions.
A Chinese-speaking operator nicknamed 'Miku' conducted a global campaign involving SQL injection, credential spraying, and LLM-assisted reconnaissance against government, military, and commercial targets in Pakistan, Vietnam, and Mexico.
The N0va phishkit targets US and EU organizations across multiple sectors using device code authentication flows to capture access tokens and establish persistent SSO access.
PREY-0058 (UNC6671) uses help-desk vishing and AiTM phishing to steal Microsoft 365 session tokens for bulk data exfiltration from SharePoint and Exchange via residential proxies.
Threat actors are using infostealers like Lumma and Vidar to harvest session tokens and API keys for AI services to bypass MFA and conduct LLMjacking.
The threat actor 'General Boss' operates BigBear 2.0, an Evilginx2-based Phishing-as-a-Service framework targeting Microsoft 365 accounts globally using AiTM techniques to bypass MFA.
Threat actors are increasingly using infostealers like Lumma and Vidar to harvest session tokens and API keys for AI services to bypass MFA and hijack high-cost compute resources.
The Forg365 Phishing-as-a-Service platform utilizes AI-assisted lures, device-code flow abuse, and a custom browser extension to compromise and maintain access to Microsoft 365 environments.
Mandiant researchers identified a method for attackers to recover active ADFS signing keys from Machine DPAPI when configuration drift occurs during manual certificate rotations, enabling Golden SAML token forgery.
