Browse public community intelligence reports, source analysis, and threat research.
120 intel reports
An unidentified threat actor utilizes renamed Python interpreters and custom ._pth files to execute malicious code without command-line arguments, eventually attempting to deploy ScreenConnect via a UAC bypass.
Akira ransomware targets global organizations across Windows and Linux platforms using double extortion, vulnerability exploitation, and credential theft.
Mir0Auth is a sophisticated phishing kit that abuses the Microsoft OAuth device authorization grant to harvest session tokens and bypass MFA.
China-aligned threat actor TA419 is conducting credential phishing campaigns against AI policy experts at US think tanks and universities using advanced AitM techniques.
Earth Sirrush (UAC-0099) utilizes evolving .NET malware, steganographic delivery, and trojanized applications to target Ukrainian government and logistics sectors for long-term espionage.
Attackers exploited an HTML injection vulnerability in xAI's email invite template to send malicious links from legitimate x.ai domains.
Threat actors are increasingly using AI-powered Phishing-as-a-Service (PhaaS) kits like the Jalisco toolkit to bypass MFA via device code phishing and OAuth token harvesting.
The Kali365 Phishing-as-a-Service platform exploits Microsoft's device code authentication flow to bypass MFA and capture persistent OAuth tokens for M365 environments.
The threat actor UAT-11985 is targeting Taiwan research organizations using AI-generated spear-phishing lures and QR codes to drive victims toward an Adversary-in-the-Middle (AitM) framework for harvesting Google account credentials and MFA codes.
China-aligned threat actor TA419 is conducting credential phishing campaigns against U.S. AI policy experts using Adversary-in-the-Middle (AitM) techniques and a customized Frameless BitB kit.
