Browse public community intelligence reports, source analysis, and threat research.
184 intel reports
Bluekit PhaaS leverages advanced Browser-in-the-Middle (BitM) techniques and AI to bypass MFA by streaming live DOM interactions to victims.
Threat actor abdrizak uses typosquatted npm packages like postcss-minify-selector-parser to deliver a multi-stage Windows RAT targeting developer environments.
Initial Access Broker Woodgnat (KongTuke) is deploying the Mistic and MLTBackdoor RATs via social engineering and compromised WordPress sites to sell network access to major ransomware affiliates.
A campaign involving hijacked npm and Go packages uses malicious VS Code tasks to trigger a multi-stage infection chain involving blockchain dead drops, a socket.io backdoor, and a Python infostealer.
A multi-stage steganographic loader campaign uses .NET-based binaries and bitmap objects to deploy payloads like Remcos RAT, Agent Tesla, and Red Line Stealer primarily targeting users in India.
An actor published 15 npm packages using 13 throwaway scopes to deliver a multi-stage Rust-compiled infostealer targeting developer and crypto credentials.
An unidentified threat actor is targeting Thailand's healthcare sector using healthcare-themed lures to deploy a Python-based information stealer via multi-stage batch scripts.
An unidentified threat actor used ClickFix social engineering to deploy Potemkin Loader and RMMProject, moving laterally via SMBExec to distribute EtherRAT across 11 hosts.
DPRK-aligned actors are deploying macOS.Gaslight, a Rust-based backdoor that utilizes prompt injection payloads to subvert LLM-assisted malware analysis pipelines.
The Gentlemen Ransomware-as-a-Service (RaaS) group utilizes a sophisticated EDR-killing framework and targets global organizations using leaked Fortinet VPN credentials.
