Browse public community intelligence reports, source analysis, and threat research.
9 intel reports
An unattributed threat actor, possibly using AI-assisted automation, is abusing stolen Entra ID and Azure DevOps workload credentials to harvest secrets and move laterally across MSP client tenants.
China-state aligned actor Storm-0940 utilized the ARTEX agentic AI framework to automate a large-scale supply chain compromise targeting ConnectWise applications and downstream cloud environments.
Russian-speaking threat actor Azazel, an affiliate of the Gentlemen ransomware group, utilizes stolen CI/CD secrets and novel MCP-based C2 channels to target global sectors and host stolen data on an independent leak site, LEAKNED.
Unknown actors compromised MemTensor packages on npm and PyPI to deliver 'sckit', a Go-based worm designed for credential harvesting and self-propagation via CI/CD pipelines.
The Phexia threat actor uses fake CAPTCHA 'ClickFix' lures to deploy a macOS backdoor that resolves its C2 hostname via a Polygon smart contract and drops multiple infostealers.
The WhiteCobra threat actor is deploying malicious 'Solidity Pro' VS Code extensions that evolve from Cloudflare-hosted Python droppers to comprehensive credential and wallet infostealers.
The Trum3it campaign utilizes a fake Polymarket arbitrage bot and 42 malicious npm packages to deliver an infostealer targeting DeFi developer credentials and crypto wallets.
Threat actors are exploiting CVE-2026-48558 in SimpleHelp RMM to deploy TaskWeaver, a modular Node.js loader, and Djinn Stealer, a cross-platform information stealer targeting developer and AI credentials.
The UNK_DeadDrop threat actor targets developers with fake recruitment and code review phishing campaigns to deploy cross-platform malware for cryptocurrency theft.
