Browse public community intelligence reports, source analysis, and threat research.
1,186 intel reports
The Astaroth (Guildma) banking trojan has integrated a new browser-automated WhatsApp Web spambot to propagate malware through trusted social contacts, primarily targeting Brazilian users.
Attackers are chaining a REST API batch-route confusion vulnerability (CVE-2026-63030) and a SQL injection (CVE-2026-60137) to achieve unauthenticated remote code execution on WordPress Core.
Suspected Chinese-speaking threat actors target Central Asian government sectors using two new obfuscated backdoors, OctLurk and SilkLurk, for data theft and persistent access.
The FakeGit campaign leverages 7,600 malicious GitHub repositories and the 'AgentBaiting' technique to trick AI agents into recommending SmartLoader and StealC malware.
The Chaos ransomware group is using a new Rust-based RAT called msaRAT that establishes covert C2 channels by hijacking headless Chrome and Edge browsers via the Chrome DevTools Protocol.
A new Windows infostealer called Dolphin X, sold by the actor Kontraktnik, uses AI-driven triage to prioritize high-value corporate and DevOps targets.
EtherHiding malware on macOS uses Polygon smart contracts as dead-drop resolvers for C2 domain rotation to evade traditional sinkholing and detection.
APT28 (Fancy Bear) is conducting a global campaign named FrostArmada, hijacking SOHO router DNS settings to facilitate adversary-in-the-middle attacks targeting Microsoft 365 credentials.
The PhantomEnigma campaign leverages compromised Brazilian .gov.br infrastructure to deliver a modular Node.js backdoor aimed at banking credential theft.
BlueNoroff is utilizing an advanced phishing kit to impersonate Zoom and Microsoft Teams, profiling cryptocurrency wallets before delivering tailored malware to high-value targets.
