Browse public community intelligence reports, source analysis, and threat research.
1,190 intel reports
Attackers compromised Adform's advertising tracking script trackpoint-async.js to replace cryptocurrency wallet addresses in user clipboards and web forms.
Russia-aligned actor TA488 is leveraging a critical XSS vulnerability in Outlook Web Access to deploy OWAReaper, a sophisticated browser-based implant for persistent mailbox access.
Threat actors are actively exploiting critical deserialization vulnerabilities in on-premises Microsoft SharePoint Server to achieve remote code execution and maintain persistence via machine key theft.
Researchers identified 84 'iTrue' vulnerabilities in cellular core networks arising from implicit trust between components, enabling denial-of-service and session hijacking across major open-source and commercial implementations.
Cl0p ransomware affiliates are exploiting a critical RCE vulnerability (CVE-2026-12569) in PTC Windchill and FlexPLM systems to deploy JSP webshells and exfiltrate data.
Mirage Kitten (UNC1549) is deploying a new malware set including the NightLedger backdoor and WebSocket-based tunnelers targeting aerospace, defense, and telecommunications sectors.
The XCSSET malware family has evolved to version 40, employing advanced in-memory execution, polymorphic payloads, and supply chain infection via poisoned Xcode projects targeting macOS developers.
HOLLOWGRAPH is a .NET NativeAOT Windows backdoor that utilizes compromised Microsoft 365 calendar events for covert command-and-control and exfiltration.
An attacker targeted a medical device manufacturer with a Fifth Third Bank lure using CSS-hidden ASCII characters to evade security scanners while maintaining DMARC alignment via DKIM.
The threat actor Storm-2372 is utilizing AI-built phishing kits, TokenLover and YaksaLover, to automate large-scale BEC attacks and persistence via Windows Hello for Business key injection.
