Browse public community intelligence reports, source analysis, and threat research.
1,186 intel reports
Researchers identified multiple vulnerabilities in the Cursor AI IDE, including workspace binary planting and malicious MCP server installations, leading to remote code execution.
Salat Stealer, a Go-based information stealer, is distributed via gaming utilities like Xeno Executor to harvest credentials, crypto wallets, and perform live surveillance.
Russian FSB Center 16 (Static Tundra) targets critical infrastructure by exploiting weak SNMP configurations and legacy Cisco vulnerabilities to exfiltrate device configurations.
An unprivileged user can exploit a logic flaw in the Windows Installer service to delete arbitrary folders as SYSTEM and subsequently execute code by planting malicious rollback scripts.
The ModHeader browser extension (v7.0.17) exfiltrates user browsing history to a covert C2 domain using encrypted IndexedDB storage and randomized upload schedules.
The DEBULL PhaaS framework leverages Microsoft device-code phishing and the GraphSpy post-exploitation tool to compromise Microsoft 365 tenants using Storm-2372-style tradecraft.
The MemGhost framework automates stealth memory injection into persistent AI agents like OpenClaw, enabling long-term compromise via a single adversarial email.
Educational writeup documenting various SQL Injection (SQLi) techniques, including UNION-based, blind, error-based, and out-of-band exfiltration targeting common SGBDs.
An unknown Chinese-speaking APT group is targeting Russian critical sectors by exploiting the ViPNet update system to deploy a suite of malicious modules including HelloInjector and HelloProxy.
The GoSerpent campaign utilizes a sophisticated suite of Go-based backdoors and specialized loaders to collect and exfiltrate sensitive data from government and diplomatic entities in Southeast Asia.
