Browse public community intelligence reports, source analysis, and threat research.
101 intel reports
The threat actor ShinyHunters and affiliated clusters are targeting SaaS platforms, specifically Salesforce, using vishing and OAuth integration abuse for data exfiltration and extortion.
Threat actors are increasingly using LLMs to generate bespoke, functional malware and automate complex Active Directory enumeration, data exfiltration, and extortion workflows.
Researchers identified multiple vulnerabilities in the Cursor AI IDE, including workspace binary planting and malicious MCP server installations, leading to remote code execution.
The MemGhost framework automates stealth memory injection into persistent AI agents like OpenClaw, enabling long-term compromise via a single adversarial email.
The Helix data extortion group uses social engineering and device code phishing to hijack Microsoft 365 accounts and exfiltrate sensitive SharePoint data.
The threat actor O-UNC-066 is using vishing and a real-time operator-controlled phishing kit to trick users into enrolling attacker-controlled passkeys for Microsoft 365 access.
An active Microsoft 365 phishing campaign abuses the legitimate OAuth 2.0 Device Authorization Grant flow to bypass traditional credential theft and gain account access.
Detection opportunities and rules for TAG-182's MarkiRAT campaign, covering fake VPN/media-player lures, BITS job abuse, svehost.exe masquerading, and typosquatted C2 infrastructure impersonating maj…
The O-UNC-066 threat actor is targeting Microsoft 365 users through vishing and real-time phishing panels to hijack Entra passkey enrollment for data extortion.
A Vidar malware-as-a-service affiliate is targeting SMBs with a dual-payload infection of the Vidar infostealer and XMRig miner delivered via malicious software cracks.
