Node2Shell: Node.js Brotli Remote Code Execution Vulnerability
A high-severity out-of-bounds write vulnerability in the Node.js Brotli decoder (Node2Shell) allows remote code execution when processing malformed compressed data.

Browse public community intelligence reports, source analysis, and threat research.
4 intel reports
Cybercriminals are using multiple infostealer families and malicious Claude Artifacts to bypass 2FA by stealing session cookies and hijacking AI agent configurations.
ACR Stealer (formerly Amatera Stealer) employs ClickFix social engineering, WebDAV delivery, and steganography to steal browser credentials and sensitive documents from Windows and macOS environments.
The China-linked threat actor Silver Fox (UTG-Q-1000) is utilizing SEO poisoning and counterfeit installers to deliver a modular Rust-based RAT called MODBEACON featuring gRPC-encrypted communications.
KongTuke and PS1Bot campaigns leverage malicious browser extensions and malvertising to deliver modular RATs and information stealers targeting Windows and macOS systems.