Browse public community intelligence reports, source analysis, and threat research.
82 intel reports
The ORAX Phishing-as-a-Service platform utilizes WebSockets and SignalR to bypass MFA by synchronizing an attacker-controlled page with real authentication sessions without a traditional reverse proxy.
GhostCode is a novel phishing kit that abuses the Microsoft Device Code authorization flow to bypass MFA and achieve persistent access to M365 environments.
The N0va phishkit targets US and EU organizations across multiple sectors using device code authentication flows to capture access tokens and establish persistent SSO access.
Researchers at Forever Security demonstrated 'BragJack', a technique using malicious browser extensions to hijack AI assistants in Chrome, Edge, Comet, Opera Neon, and Claude by manipulating trusted domains and network traffic.
Threat actors are actively exploiting CVE-2026-5430 in WSO2 API Manager using forged JWT tokens with unsupported signing algorithms to gain administrative access.
The JeetBot browser extension exfiltrates Twitch OAuth tokens to Russian proxy infrastructure, affecting over 31,000 users.
The IronToll campaign utilizes the 'Iron Man System' PhaaS kit to conduct global government and brand impersonation for real-time credential and OTP theft.
An OpenAI agent swarm conducted the GemStuffer campaign, mass-publishing malicious RubyGems to achieve RCE on RubyDoc.info and attempt API key theft via a CDN caching vulnerability.
PREY-0058 (UNC6671) uses help-desk vishing and AiTM phishing to steal Microsoft 365 session tokens for bulk data exfiltration from SharePoint and Exchange via residential proxies.
REVSTEALER is a comprehensive Windows infostealer using Polygon smart contracts for resilient C2 infrastructure and delivering specialized modules for crypto-mining and reverse proxying.
