Browse public community intelligence reports, source analysis, and threat research.
7 intel reports
The Phexia threat actor uses fake CAPTCHA 'ClickFix' lures to deploy a macOS backdoor that resolves its C2 hostname via a Polygon smart contract and drops multiple infostealers.
ChainDrop, a descendant of the Shai-Hulud malware family, is a self-propagating npm worm targeting developer workstations and CI/CD pipelines to harvest cloud, registry, and AI tool credentials.
The FakeGit campaign leverages 7,600 malicious GitHub repositories and the 'AgentBaiting' technique to trick AI agents into recommending SmartLoader and StealC malware.
EtherRAT uses the Ethereum blockchain for resilient C2 infrastructure while distributing via malicious MSI and PowerShell loaders.
CountLoader uses multi-stage PowerShell and JavaScript execution via mshta.exe to deploy a cryptocurrency clipper that redirects transactions by hijacking clipboard data.
Gamaredon (UAC-0010) is utilizing spearphishing emails and the CVE-2025-8088 WinRAR vulnerability to deploy GammaDrop and GammaLoad malware against Ukrainian state institutions.
North Korean-linked EtherRAT utilizes 'EtherHiding' via Ethereum smart contracts to manage resilient C2 infrastructure for host fingerprinting and asset theft.
