Browse public community intelligence reports, source analysis, and threat research.
120 intel reports
Storm-2755 (Payroll Pirates) uses AiTM phishing and residential proxies to compromise Microsoft 365 accounts for financial data theft and payroll diversion.
Cymulate Research Lab identified a stored cross-site scripting (XSS) vulnerability in Microsoft Purview Communication Compliance that allows external attackers to steal session tokens and achieve account takeover of compliance analysts.
Cybercriminals are stealing AI API tokens using supply chain attacks and infostealers to fuel gray-market 'transfer station' proxy services, causing massive financial losses.
The SMOKE#SCREEN campaign utilizes diverse social engineering lures and aggressive security-dismantling toolsets to deploy persistent ScreenConnect RMM agents on Windows and macOS systems.
UNC6692 uses email bombing and IT impersonation via Microsoft Teams to deploy the Edgecution/SNOW malware suite and facilitate ransomware access.
A state-sponsored threat group and Gunra ransomware actors exploited vulnerabilities in South Korean financial security software like AnySign4PC to deploy SIGNBT and COPPERHEDGE backdoors via watering holes.
Attackers are using cloned greeting-card templates with globally rewritten anchors to deliver ScreenConnect remote-access installers targeting healthcare data-protection roles.
Threat actors are utilizing fake software updates and gaming cheats to deploy ScreenConnect RMM agents and the Powercat Java stealer for persistent access and credential theft.
An attacker targeted a medical device manufacturer with a Fifth Third Bank lure using CSS-hidden ASCII characters to evade security scanners while maintaining DMARC alignment via DKIM.
Attackers are impersonating Interactive Brokers using a tax-themed W-8BEN expiration lure and 0-day domains to harvest credentials from healthcare sector employees.
