Browse public community intelligence reports, source analysis, and threat research.
183 intel reports
Russia-aligned threat actor UAC-0099 is using the GuardBreaker technique to trip AI safety guardrails and blind automated malware analysis tools targeting Ukrainian critical infrastructure.
Threat actors are using infostealers like Lumma and Vidar to harvest session tokens and API keys for AI services to bypass MFA and conduct LLMjacking.
REVSTEALER is a comprehensive Windows infostealer using Polygon smart contracts for resilient C2 infrastructure and delivering specialized modules for crypto-mining and reverse proxying.
Threat actors are increasingly using infostealers like Lumma and Vidar to harvest session tokens and API keys for AI services to bypass MFA and hijack high-cost compute resources.
A Chinese-speaking operator uses the PEEP toolkit, a RedExt derivative, to transform Chromium browsers into persistent host-level backdoors via native-messaging bridges.
An unidentified actor compromised Coder's Cloudflare-managed registry infrastructure to distribute malicious Terraform modules that steal infrastructure credentials and API keys.
DPRK-linked actors (Kimsuky, APT37, Lazarus) are using the Ted backdoor and CurlRAT framework to target South Korean media and automotive sectors for long-term espionage and watering-hole attacks.
The WEEVILPROXY threat actor is deploying JSCeal, a compiled V8 JavaScript malware that uses stolen session cookies to bypass Google authentication and target cryptocurrency investors.
Cybercriminals are using multiple infostealer families and malicious Claude Artifacts to bypass 2FA by stealing session cookies and hijacking AI agent configurations.
Lazarus Group is targeting macOS users with trojanized application installers that deliver the OtterCookie RAT through a multi-stage infection chain.
