Browse public community intelligence reports, source analysis, and threat research.
184 intel reports
Lazarus Group is targeting macOS users with trojanized application installers that deliver the OtterCookie RAT through a multi-stage infection chain.
ClickFix campaign leverages pcalua.exe and WMI to mount remote WebDAV shares for executing infostealer DLLs via rundll32.exe.
The BRIDGEHEAD campaign utilizes 40 npm typosquatting packages to jump from WSL environments to Windows hosts, deploying a Rust-based stealer for cryptocurrency wallets and browser credentials.
The Dark Caracal threat actor is deploying a modular Go-based framework named GoCaracal that utilizes Ethereum smart contracts for resilient command-and-control infrastructure.
The gaiadeqi.com campaign utilizes highly obfuscated JavaScript droppers to deliver credential-stealing trojans disguised as VLC Media Player installers.
A cluster of trojanized npm packages delivers the RedShell Linux implant, which features an AI-driven post-exploitation layer called Red Agent.
Sapphire Sleet (DPRK) compromised popular Rust crates including arrayref and append-only-vec by injecting a malicious typosquatted dependency, proc-macro1, to execute a second-stage backdoor at build time.
The ClearFake campaign utilizes a new WordlistLoader to deliver Amatera Stealer (ACR Stealer) through social engineering techniques like FakeCaptcha and advanced WoW64 evasion.
The Offside Wallet Theft Factory campaign utilizes 77 malicious Firefox extensions to steal cryptocurrency secrets and credentials by masquerading as Web3 tools and sports-score utilities.
AmnesiaStealer is a multi-stage Rust-based macOS infostealer that uses ClickFix lures and a remote streaming module to gain live, hidden control of Chromium browsers.
