Browse public community intelligence reports, source analysis, and threat research.
184 intel reports
Pony is a long-standing credential stealer and downloader that targets various applications and uses dictionary attacks against local Windows accounts to deliver second-stage payloads like ZeuS.
The Drun Backdoor is a modular two-stage infostealer that utilizes the Chromelevator loader to inject into processes via direct syscalls, targeting browser credentials, session tokens, and gaming accounts.
A Russian-speaking attacker is deploying the Meow AppleScript RAT via ClickFix social engineering lures to exfiltrate data and hijack cryptocurrency wallets on macOS.
The MexicanMafia threat actor, also known as PanchoVilla, is conducting a sophisticated campaign using the Kimera reconnaissance engine and custom exploits against perimeter devices in Latin America.
The Mastra AI framework suffered a supply chain attack involving over 140 compromised npm packages that deliver a cross-platform infostealer via a typosquatted dependency.
Financially motivated actors like Vanilla Tempest are leveraging ClickFix social engineering to deliver modular loaders including BabaDeda, Lorem Ipsum, and Potemkin, ultimately deploying ransomware like Rhysida.
The Phantom Stealer campaign targets banks and high-value organizations using fileless techniques and a layered dropper to exfiltrate browser credentials and financial data.
Amos Stealer targets macOS environments to harvest browser credentials, Apple Keychains, and developer configuration files using sophisticated AppleScript and shell script execution.
KongTuke and PS1Bot campaigns leverage malicious browser extensions and malvertising to deliver modular RATs and information stealers targeting Windows and macOS systems.
The Colombian Smugglers group and other actors utilize techniques like Device Code Phishing and SVG smuggling to deliver malware including rmrlx, vjw0rm, and UnixStealer.
