Browse public community intelligence reports, source analysis, and threat research.
120 intel reports
An unidentified threat actor is conducting a global phishing campaign using Vercel-hosted lures to deliver legitimate, signed RMM tools for remote system access.
The IronToll campaign utilizes the 'Iron Man System' PhaaS kit to conduct global government and brand impersonation for real-time credential and OTP theft.
State-aligned threat actors, primarily China-linked, are deploying the BlueMoon exploit kit to leverage Chrome and Windows zero-days for rapid espionage campaigns.
CRPx0 is a sophisticated cross-platform ransomware-as-a-service operation using ClickFix social engineering lures to deliver multi-stage Python-based payloads via clipboard hijacking.
The threat actor 'General Boss' operates BigBear 2.0, an Evilginx2-based Phishing-as-a-Service framework targeting Microsoft 365 accounts globally using AiTM techniques to bypass MFA.
Suspected Silver Fox actors are targeting Latin American banking and financial sectors using fake DocuSign and NFe tax lures to deliver a custom HVNC backdoor for persistent remote control.
SilkParasite is a China-nexus cyberespionage cluster targeting Central Asian government entities using a modular arsenal of seven RAT families, including five previously undocumented tools and AI-assisted tradecraft.
Attackers are abusing legitimate Microsoft device-code OAuth workflows via deceptive document-verification pages to steal access tokens and bypass MFA.
The Knight Office phishing kit uses Adversary-in-the-Middle (AiTM) techniques and device code phishing to bypass MFA and hijack Microsoft 365 session tokens.
Threat actors are abusing the legitimate Faronics Deploy platform to execute malicious PowerShell scripts and establish persistent remote access via ScreenConnect.
