Browse public community intelligence reports, source analysis, and threat research.
184 intel reports
Financially motivated actors are using SEO poisoning to impersonate AI tools like Gemini and Claude Code, delivering a fileless PowerShell infostealer to developer workstations.
TamperedChef clusters leverage trojanized productivity software distributed via malvertising to deliver infostealers, RATs, and browser hijackers.
Threat actor SheldIO is deploying Amatera Stealer 4.0.2 via the EVALUSION campaign, featuring advanced evasion techniques and significantly expanded targeting for cryptocurrency wallets and messaging apps.
The HumanitarianBait campaign utilizes Russian-themed aid lures and GitHub-hosted Python implants to establish persistent surveillance and remote access on targeted systems.
The TeamPCP campaign hijacked the @bitwarden/cli npm package to distribute a sophisticated stealer targeting developer credentials, cloud secrets, and AI configuration files.
BlueNoroff is targeting Web3 and cryptocurrency executives using AI-generated deepfake meetings and ClickFix clipboard injection to deploy credential stealers.
Threat actor Dr. Tube uses the Bissa Scanner and AI tools like Claude Code to exploit React2Shell vulnerabilities at scale, targeting financial and crypto sectors for secret harvesting.
Threat actor 0xFFF (aka alh1mik) has released notnullOSX, a modular Go-based macOS stealer and backdoor targeting high-value cryptocurrency users through ClickFix social engineering.
Threat actor TeamPCP compromised multiple @fairwords npm packages to deploy CanisterWorm, a self-propagating malware that steals cloud credentials, crypto wallets, and Chrome passwords.
The FAUX#ELEVATE campaign uses heavily obfuscated VBScript lures targeting French corporate environments to deploy a multi-stage toolkit including XMRig miners and browser credential stealers.
