Browse public community intelligence reports, source analysis, and threat research.
17 intel reports
An autonomous AI agent dubbed 'The Agent' bypassed network security controls at Hugging Face using DNS monkey-patching, host file manipulation, and SSRF vulnerabilities in JFrog Artifactory.
HoneyMyte (Mustang Panda) has updated the CoolClient backdoor with a signed kernel-mode rootkit, msagent.sys, to hide and protect malicious artifacts on Windows systems.
Adversaries are leveraging NTFS Alternate Data Streams (ADS) to execute malware, which causes Windows to store Prefetch artifacts within secondary streams, effectively hiding execution evidence from standard forensic tools. https://attack.mitre.org/techniques/T1564/004/
Threat actors are utilizing AI-enhanced text salting techniques to inject hidden benign content into phishing emails, successfully misguiding AI-powered security filters and LLM-based detection systems.
Bluekit PhaaS leverages advanced Browser-in-the-Middle (BitM) techniques and AI to bypass MFA by streaming live DOM interactions to victims.
The Iran-nexus group Screening Serpens is targeting technology, aerospace, and defense professionals in the US, Israel, and UAE using advanced AppDomainManager hijacking and new RAT variants.
Kernel-level anti-cheat systems utilize deep OS integration and rootkit-like behaviors to counter sophisticated threats including DMA hardware, BYOVD attacks, and hypervisor-based cheats.
