Browse public community intelligence reports, source analysis, and threat research.
6 intel reports
UNC7017 conducted ephemeral supply chain tampering against AOMEI Technology update servers to deliver CROSSROAD and SHINYROAD malware via short-burst configuration modifications.
An unprivileged user can exploit a logic flaw in the Windows Installer service to delete arbitrary folders as SYSTEM and subsequently execute code by planting malicious rollback scripts.
The threat actor Nightmare Eclipse released the RoguePlanet zero-day exploit (CVE-2026-50656) targeting a race condition in Microsoft Defender to achieve SYSTEM privileges on Windows 10 and 11.
A high-ca pability . NET-based infosteale r targetin g multiple browsers, Discord t okens, an d system f ingerprint s while by passing Ch rome App-B ound Encry ption via DLL inject ion.
Nightmare Eclipse exploits a flaw in Windows Defender's Cloud Files remediation logic to achieve arbitrary file writes and SYSTEM execution via NTFS junctions and oplocks.
The InstallFix campaign utilizes Google Ads and fake Claude AI installation pages to deliver RedLine Stealer through a complex, multi-stage infection chain.
