Browse public community intelligence reports, source analysis, and threat research.
9 intel reports
UNC7017 conducted ephemeral supply chain tampering against AOMEI Technology update servers to deliver CROSSROAD and SHINYROAD malware via short-burst configuration modifications.
A vulnerability chain in OnePlus OxygenOS allows a no-permission malicious app to achieve full root access by exploiting AtlasService and a vendor-specific olc2 HAL.
China-aligned actor FamousSparrow is targeting Latin American governments with SparroWocky, a sophisticated C++ backdoor featuring advanced anti-analysis and modular execution capabilities.
The Superior threat actor uses 19 malicious Chrome and Edge extensions to deliver wallet drainers and credential-stealing payloads through a modular JavaScript framework.
Anonymous researcher 'bikini' released Exploitarium, a repository containing over 30 proof-of-concept exploits for unpatched vulnerabilities across multiple software projects, including critical flaws in libssh2 and Gitea.
The threat actor Nightmare Eclipse released the RoguePlanet zero-day exploit (CVE-2026-50656) targeting a race condition in Microsoft Defender to achieve SYSTEM privileges on Windows 10 and 11.
The emiltype actor published a malicious npm package nodemon-sudo that uses the dependency tslint-conf to fetch and execute a second-stage payload via IPFS at runtime.
The Russia-linked Turla group is deploying STOCKSTAY, a multi-component .NET backdoor masquerading as benign utilities, to target government and military entities in Ukraine and Europe.
The PromptSpy surveillance platform uses a two-stage Android malware infection chain to establish persistent VNC remote control and file exfiltration capability.
