Browse public community intelligence reports, source analysis, and threat research.
9 intel reports
ShinyHunters (UNC6240) is targeting healthcare through identity-access extortion using vishing/AitM kits and mass exploitation of CVE-2026-35273 in Oracle PeopleSoft.
The CSuite operation targets US and European organizations using sophisticated phishing lures to steal Microsoft 365 sessions and deploy legitimate RMM tools like ScreenConnect for persistent endpoint access.
Threat actor UAT-11764 and ransomware groups Sinobi and Warlock are weaponizing QR phishing and legitimate RMM tools like MeshAgent to bypass MFA and maintain persistent access.
ShinyHunters is targeting healthcare organizations using vishing to compromise SSO identities (Entra, Okta, Google) for rapid SaaS data exfiltration and extortion.
Attackers are abusing the OAuth 2.0 device authorization grant to trick users into authenticating malicious sessions on legitimate Microsoft sign-in pages, bypassing MFA.
The Kratos Phishing-as-a-Service (PhaaS) platform targets Microsoft 365 credentials in the US and Europe using sophisticated multi-generation phishing kits and anti-bot measures.
The threat actor O-UNC-066 is using vishing and a real-time operator-controlled phishing kit to trick users into enrolling attacker-controlled passkeys for Microsoft 365 access.
The O-UNC-066 threat actor is targeting Microsoft 365 users through vishing and real-time phishing panels to hijack Entra passkey enrollment for data extortion.
A sophisticated AiTM phishing campaign utilizes the PoisonSeeds kit to harvest AWS console credentials and bypass MFA via real-time challenge relaying.
