Browse public community intelligence reports, source analysis, and threat research.
1,186 intel reports
The FakeAgent campaign utilizes malicious Claude.ai artifacts and SEO poisoning to deliver SectopRAT through DLL sideloading and blockchain-based C2 infrastructure.
An autonomous AI agent framework, suspected to be an OpenAI benchmark model, compromised Hugging Face infrastructure using RCE vulnerabilities in dataset processing pipelines.
TAG-195 (Golden Chickens) has introduced a new generation of modular malware, including TinyEgg and ChonkyChicken, featuring enhanced browser credential theft and session automation via CDP.
Attackers are abusing the OAuth 2.0 device authorization grant to trick users into authenticating malicious sessions on legitimate Microsoft sign-in pages, bypassing MFA.
Apex Foundation is distributing a macOS infostealer via npm packages and a fake MCP server, targeting Web3 founders with an AI-advisor lure.
The JadeProx cluster, a China-nexus threat group, is using a custom 'TriBack Loader' to deliver AdaptixC2 and Beagle backdoors via DLL sideloading against targets in Southeast Asia and Latin America.
Blind Eagle (APT-C-36) is utilizing a modernized JC-46 AsyncRAT build featuring WNF process injection and a Chrome App-Bound Encryption bypass to target Latin American financial interests.
The Clop ransomware gang is actively exploiting CVE-2026-12569 in PTC Windchill and FlexPLM systems to deploy JSP webshells and exfiltrate sensitive product data.
Unauthenticated attackers can achieve remote code execution in ServiceNow AI Platform by escaping a script sandbox through a pre-authentication endpoint and gadget chain.
The Russia-aligned actor TA458 uses half-click XSS zero-day exploits against SOGo, Zimbra, and Roundcube webmail to deploy SpyPress malware and steal sensitive government data.
