Browse public community intelligence reports, source analysis, and threat research.
Critical unauthenticated remote code execution flaws in PHP core (CVE-2026-109618 and CVE-2026-109619) allow attackers to take full control of web servers by exploiting memory corruption in session upload progress and fatal error handling.
1,186 intel reports
EvilTokens and other phishing frameworks are increasingly abusing the Microsoft Device Code Flow to bypass MFA and conduct Business Email Compromise (BEC) at scale.
Mustang Panda APT utilizes a multi-stage PlugX execution chain involving legitimate G DATA binaries and complex obfuscation to target systems via fake browser updates.
The PromptSpy surveillance platform uses a two-stage Android malware infection chain to establish persistent VNC remote control and file exfiltration capability.
A highly sophisticated multi-stage npm supply chain campaign targeting Red Hat and AI-related packages uses GitHub as an adaptive C2 to deploy the Shai-Hulud infostealer variant 'Miasma'.
The Silver Fox threat actor targets Japanese and Chinese organizations using spear-phishing to deploy the modular 10FXRAT and the PoisonX kernel driver for security product bypass.
Windows Search URI handlers are vulnerable to an unpatched NTLM leakage primitive that allows remote attackers to capture Net-NTLMv2 hashes via a single link click.
Nightmare Eclipse exploits a flaw in Windows Defender's Cloud Files remediation logic to achieve arbitrary file writes and SYSTEM execution via NTFS junctions and oplocks.
The Miasma threat actor compromised 56 npm packages to steal CI/CD secrets and deploy persistent backdoors using a novel binding.gyp execution trigger.
The SStar Agent is a Go-based cross-platform RAT delivered via a poisoned npm package (tw-style-utils) targeting Web3 developers with surveillance and exfiltration capabilities.
An attacker can steal broadly-scoped GitHub OAuth tokens by exploiting VSCode webview message handling to simulate keystrokes and install malicious extensions.
