Browse public community intelligence reports, source analysis, and threat research.
29 intel reports
Suspected TraderTraitor group targets developers using trojanized Terraform providers to deliver cross-platform FLATROOF and ROOFDECK malware via lookalike domains and GitHub.
The GlowComa threat actor is distributing ICMacOS, a macOS-targeted Malware-as-a-Service that has evolved from an information stealer into a persistent Remote Access Trojan (RAT).
The suspected TraderTraitor group is using trojanized Terraform providers to deliver cross-platform FLATROOF and ROOFDECK malware for credential theft and persistent access.
The P7 variant of DarkSword targets iOS 18.x devices using chained vulnerabilities to exfiltrate keychain data, cryptocurrency wallets, and Apple Notes via a sophisticated two-way C2 architecture.
The MacSync family has evolved from AppleScript-based AMOS variants into a complex multi-stage binary infection chain targeting macOS users and developers to steal crypto and credentials.
The Phexia threat actor uses fake CAPTCHA 'ClickFix' lures to deploy a macOS backdoor that resolves its C2 hostname via a Polygon smart contract and drops multiple infostealers.
The North Korean threat actor Jade Sleet (TraderTraitor) is targeting DevOps engineers at IT services firms using weaponized Terraform coding projects and macOS backdoors FLATROOF and ROOFDECK.
PamStealer targets macOS users via fake 'Wavel' crypto wallet lures, utilizing a novel live server-side decryption utility (pkgunpack) and a Swift-based infostealer payload.
ClickLock is a macOS information stealer and backdoor that uses social engineering and process-killing loops to coerce users into surrendering administrative credentials.
AmnesiaStealer is a multi-stage Rust-based macOS infostealer that uses ClickFix lures and a remote streaming module to gain live, hidden control of Chromium browsers.
