Browse public community intelligence reports, source analysis, and threat research.
12 intel reports
CastleStealer and CastleLoader use browser protection bypasses and ClickFix social engineering to exfiltrate sensitive data and deploy secondary RATs like NetSupport.
AdFection is a technique used by spyware vendors like Candiru to deliver zero-click surveillance malware by exploiting real-time bidding in the digital advertising ecosystem.
Candiru and other mercenary spyware vendors use a technique called AdFection to deliver zero-click malware and conduct mass-deanonymization through the real-time bidding advertising ecosystem.
A self-proclaimed bug bounty hunter utilizes LLM-generated JavaScript malware named PhantomRaven to compromise developer environments via typosquatted npm packages for credential theft.
SilverFox threat actors have upgraded their malware delivery chain from open access and whitelisting to a sophisticated cloud-based blacklist mechanism to evade detection by security researchers.
Threat actors known as PasteSwitch compromised the official HBO Max Reddit account to deploy ClickFix social engineering attacks, delivering macOS and Windows infostealers.
The WEEVILPROXY threat actor is deploying JSCeal, a compiled V8 JavaScript malware that uses stolen session cookies to bypass Google authentication and target cryptocurrency investors.
Threat actors are using Google Search Ads to deliver SilentMare and HollowMare malware via trojanized utility applications like PDF converters and ZIP tools.
The SourTrade malvertising campaign uses victim browsers to locally assemble unique Windows executables from legitimate components and malicious bytecode to evade hash-based detection.
KongTuke and PS1Bot campaigns leverage malicious browser extensions and malvertising to deliver modular RATs and information stealers targeting Windows and macOS systems.
