Browse public community intelligence reports, source analysis, and threat research.
120 intel reports
The SourTrade malvertising campaign uses victim browsers to locally assemble unique Windows executables from legitimate components and malicious bytecode to evade hash-based detection.
BlueNoroff is utilizing an advanced phishing kit to impersonate Zoom and Microsoft Teams, profiling cryptocurrency wallets before delivering tailored malware to high-value targets.
The PhantomEnigma campaign leverages compromised Brazilian .gov.br infrastructure to deliver a modular Node.js backdoor aimed at banking credential theft.
Attackers are abusing the OAuth 2.0 device authorization grant to trick users into authenticating malicious sessions on legitimate Microsoft sign-in pages, bypassing MFA.
Russian-affiliated threat actor CL-STA-1114 exploits a zero-click vulnerability in Zimbra Collaboration Suite to exfiltrate user credentials and email archives from global targets.
Egyptian threat actor codemado and associates leverage custom Evilginx forks and Device Code Flow abuse to target Microsoft 365 and cryptocurrency users.
Threat actor I_H8_KDot uses Inland Revenue Authority of Singapore phishing lures to deliver Overlord RAT through malicious VHDX images and DLL sideloading.
The Chinese cybercrime subgroup CylindricalCanine, part of GoldenEyeDog, targets financial organizations and certificate providers using a modified Gh0st RAT and sophisticated code-signing certificate theft.
The Kratos Phishing-as-a-Service (PhaaS) platform targets Microsoft 365 credentials in the US and Europe using sophisticated multi-generation phishing kits and anti-bot measures.
The DEBULL PhaaS framework leverages Microsoft device-code phishing and the GraphSpy post-exploitation tool to compromise Microsoft 365 tenants using Storm-2372-style tradecraft.
