Browse public community intelligence reports, source analysis, and threat research.
1,186 intel reports
ShadowDumper and SpecterInsight utilize advanced LSASS memory extraction techniques including in-memory callbacks, direct syscalls from on-disk ntdll, and obfuscation to evade EDR and AV detection.
An attacker uses indirect prompt injection in a benign-looking repository to trick the Claude Code agent into executing a reverse shell fetched via DNS TXT records.
The ToddyCat APT group utilizes Umbrij malware to compromise corporate Gmail accounts by leveraging a technique called Shadow Token via Remote Debug (STRD) to steal OAuth tokens.
An unauthenticated remote code execution vulnerability in the Argo CD repo-server component allows attackers with internal network access to take over Kubernetes clusters.
The VEIL#DROP framework utilizes Google's Blogspot platform and living-off-the-land binaries to deploy the PureLog Stealer in memory via a multi-stage fileless chain.
Mustang Panda targets Indian government and energy sectors using novel ZOHOMURK and MINIRECON implants delivered via DLL sideloading and cloud-based C2.
Analysis of six bypass techniques targeting the Windows Anti-Malware Scan Interface (AMSI) in PowerShell 5.1 and 7 using reflection, memory patching, and IL emission.
A remote code execution vulnerability in Peyara Remote Mouse 1.0.1 allows unauthenticated attackers to execute arbitrary commands by sending simulated keyboard events via WebSockets.
An Italian phishing campaign uses DLL side-loading and Chrome Native Messaging to escape the browser sandbox and execute remote PowerShell commands.
The Ousaban banking trojan utilizes geofenced phishing pages and steganography to target users in Spain and Portugal with remote access and credential theft capabilities.
