Browse public community intelligence reports, source analysis, and threat research.
1,186 intel reports
A threat actor compromised a Mastra maintainer account to poison 140+ npm packages with a malicious dependency used for cross-platform backdoors and credential exfiltration.
Armored Likho targets government and energy sectors in Russia, Brazil, and Kazakhstan using BusySnake Stealer, a Python-based infostealer distributed via AI-generated loaders and LNK files.
Banana RAT has evolved its execution chain and C2 infrastructure, transitioning from static ETW-themed paths to randomized persistence and WebSocket communication via Cloudflare.
Cavern Manticore, an Iran-nexus APT group, utilizes a modular .NET C2 framework targeting Israeli government and IT sectors through RMM abuse and DLL sideloading.
Threat actors are weaponizing the Microsoft Device Authorization Grant flow to bypass MFA and maintain persistent access to corporate Microsoft 365 environments.
ClickFix campaigns utilize fake Google and Cloudflare verification pages to trick users into executing PowerShell commands that deliver loaders like ResiLoader and various stealers.
The Iranian threat actor Cavern Manticore is targeting Israeli IT providers and government sectors using the modular Cavern C2 framework and supply chain exploitation.
ToddyCat APT uses the Umbrij tool to automate OAuth token theft from Chromium-based browsers via remote debugging ports to access victim Gmail accounts.
Adversaries target Microsoft Sentinel infrastructure to blind security teams by disabling analytic rules, shortening data retention, or altering diagnostic settings.
A malicious Chromium extension impersonates Perplexity AI to intercept search queries and capture real-time keystrokes using browser-native APIs and typosquatted infrastructure.
