Browse public community intelligence reports, source analysis, and threat research.
8 intel reports
Threat actors Storm-3121 and Storm-3032 utilize passkey-themed social engineering and AiTM phishing to compromise Microsoft cloud identities for automated data exfiltration via Microsoft Graph.
ShinyHunters (UNC6240) is targeting healthcare through identity-access extortion using vishing/AitM kits and mass exploitation of CVE-2026-35273 in Oracle PeopleSoft.
An unattributed threat actor launched a mass ACH fraud campaign using AI-assisted templates to impersonate executives and vendors, targeting accounts payable departments with highly personalized lures.
The AnonyMousKIT PhaaS platform utilizes AI voice agents and multi-channel phishing to harvest Apple ID credentials, enabling the removal of Activation Lock on stolen devices.
Adversaries abused a legitimate ServiceNow enterprise ticketing tenant to solicit sensitive financial and vendor verification data from a marine equipment manufacturer via reply-only phishing.
Threat actor UAT-11764 and ransomware groups Sinobi and Warlock are weaponizing QR phishing and legitimate RMM tools like MeshAgent to bypass MFA and maintain persistent access.
Attackers targeting financial executives use compromised small-business domains and fake HTML voicemail attachments to lure victims into calling a fraudulent Scotiabank support number.
Attackers are abusing Google Forms' editor invite feature to bypass email security and harvest sensitive information using name-matching social engineering pretexts.
