Browse public community intelligence reports, source analysis, and threat research.
10 intel reports
SkyW4lker is a device-code phishing kit targeting Microsoft 365 users, primarily in the US technology and manufacturing sectors, to bypass MFA and obtain access tokens.
ShinyHunters (UNC6240) is targeting healthcare through identity-access extortion using vishing/AitM kits and mass exploitation of CVE-2026-35273 in Oracle PeopleSoft.
An unattributed threat actor launched a mass ACH fraud campaign using AI-assisted templates to impersonate executives and vendors, targeting accounts payable departments with highly personalized lures.
The AnonyMousKIT PhaaS platform utilizes AI voice agents and multi-channel phishing to harvest Apple ID credentials, enabling the removal of Activation Lock on stolen devices.
An attacker targeted hardware wallet users using a typosquatted Ledger domain laundered through an Australian venue's authenticated transactional email infrastructure.
Adversaries abused a legitimate ServiceNow enterprise ticketing tenant to solicit sensitive financial and vendor verification data from a marine equipment manufacturer via reply-only phishing.
Attackers are impersonating Interactive Brokers using a tax-themed W-8BEN expiration lure and 0-day domains to harvest credentials from healthcare sector employees.
Attackers are abusing the OAuth 2.0 device authorization grant to trick users into authenticating malicious sessions on legitimate Microsoft sign-in pages, bypassing MFA.
An attacker used display-name impersonation and same-day registered domains to bypass standard email authentication and deliver a curiosity-based photo lure.
Threat actor link99 systematically exploits abandoned Azure and DigitalOcean DNS zone delegations to host Thai gambling platforms under the authority of over 160 enterprise and government domains.
