Browse public community intelligence reports, source analysis, and threat research.
18 intel reports
APT28 (Swallowtail) is executing a complex cyber espionage campaign targeting NATO naval and aerospace manufacturers using the Hookedge backdoor and a novel reflective loader.
Iranian state cyber actors are using CHOSEN BRICK, a Windows-based spyware, to monitor dissidents and activists through social engineering and Telegram-based command and control.
A self-proclaimed bug bounty hunter utilizes LLM-generated JavaScript malware named PhantomRaven to compromise developer environments via typosquatted npm packages for credential theft.
The NinjaMare campaign uses typosquatted domains and MSIX installers to deliver a remote-controlled input injection engine disguised as a privacy browser.
CISA red teams achieved full domain compromise and sensitive system access in two organizations, highlighting risks in cloud identity permissions and Active Directory Certificate Services (ADCS).
The Atomic macOS Stealer (AMOS) campaign utilizes 'ClickFix' social engineering on Google Sites lures to trick users into executing malicious Terminal commands.
The AnonyMousKIT PhaaS platform utilizes AI voice agents and multi-channel phishing to harvest Apple ID credentials, enabling the removal of Activation Lock on stolen devices.
Gray-market services like Poison Claude and Ecomagent exploit cloud promotional credits and synthetic identities to resell discounted, proxied access to frontier AI models.
Storm-2755 (Payroll Pirates) uses AiTM phishing and residential proxies to compromise Microsoft 365 accounts for financial data theft and payroll diversion.
The SourTrade malvertising campaign uses victim browsers to locally assemble unique Windows executables from legitimate components and malicious bytecode to evade hash-based detection.
