Browse public community intelligence reports, source analysis, and threat research.
1,186 intel reports
NadMesh is an autonomous, Go-based botnet designed to harvest AI service credentials and exploit infrastructure including Docker, Kubernetes, and Model Context Protocol (MCP) services.
Microsoft Defender for Endpoint has introduced new token context fields in Advanced Hunting to surface privileged group SIDs and logon attributes at the time of token creation.
A vulnerability in Anthropic's Claude for Chrome browser extension allows malicious extensions to trigger sensitive AI workflows by simulating untrusted user clicks.
Threat actor I_H8_KDot uses Inland Revenue Authority of Singapore phishing lures to deliver Overlord RAT through malicious VHDX images and DLL sideloading.
The popular ModHeader browser extension was discovered containing a dormant but fully functional pipeline for collecting, encrypting, and exfiltrating user browsing history.
ClickLock Dev uses ClickFix social engineering and aggressive process-killing loops to steal credentials and crypto wallets from macOS users in Europe and North America.
Threat actors are increasingly using LLMs to generate bespoke, functional malware and automate complex Active Directory enumeration, data exfiltration, and extortion workflows.
A China-linked actor is using the advanced Daxin kernel-mode rootkit alongside a novel Stupig backdoor to maintain decade-long persistence in a Taiwan manufacturing firm.
Russian-speaking threat actor UAT-11795 is utilizing ClickFix lures and trojanized software to deploy novel Python-based Starland RAT and PowerShell-based WLDR agent for cryptocurrency theft.
Adversaries can exploit Azure Container Registry permissions to push malicious images, modify ACR Tasks, and abuse Managed Identities for secret exfiltration and remote code execution.
