Browse public community intelligence reports, source analysis, and threat research.
100 intel reports
The Colombian Smugglers group and other actors utilize techniques like Device Code Phishing and SVG smuggling to deliver malware including rmrlx, vjw0rm, and UnixStealer.
Threat actor EvilTokens uses device code flow phishing to bypass MFA and obtain Primary Refresh Tokens for persistent Microsoft 365 access.
The EvilTokens Phishing-as-a-Service leverages Microsoft device code authentication flows and AI-driven automation to exfiltrate tokens and orchestrate large-scale Business Email Compromise (BEC) attacks.
A multi-stage HTA-based loader uses VBScript and PowerShell to deploy the Lightlife RAT, targeting crypto wallets and establishing persistence via Russian infrastructure.
UNC5342 utilizes the EtherHiding technique on the BNB Smart Chain testnet to host immutable ClearFake payload routing instructions targeting Windows and macOS users.
The Kali365 Live PhaaS platform enables large-scale device code phishing and AitM session capture targeting Microsoft 365 environments across multiple sectors.
Threat actors including GOLD ENCOUNTER and campaigns STAC4713/STAC3725 are abusing QEMU virtualization to hide backdoors and deploy PayoutsKing and 3AM ransomware.
Canis C2 is a previously undocumented cross-platform surveillance framework targeting Japanese users with sophisticated mobile agents and OS-specific fingerprinting.
The threat actor UAT-10362 is targeting Taiwanese NGOs and universities with a modular Lua-based stager called LucidRook and a reconnaissance tool named LucidKnight.
The EvilTokens Phishing-as-a-Service platform is weaponizing Railway.com PaaS infrastructure to conduct large-scale OAuth token replay and device code phishing campaigns against Microsoft 365 environments.
