Browse public community intelligence reports, source analysis, and threat research.
1,186 intel reports
A phishing campaign forges a long-standing healthcare sender's identity to deliver multi-hop redirect links via abused SaaS platforms for credential harvesting.
A high-severity Linux kernel vulnerability (DirtyClone) allows local attackers to achieve root access by exploiting improper shared memory flag propagation in the networking stack.
Russian-speaking threat actors are conducting a massive, automated credential-harvesting campaign named 'FortiBleed' targeting over 75,000 internet-facing Fortinet FortiGate firewalls and SSL VPNs across nearly 200 countries.
The Russia-linked Turla group is deploying STOCKSTAY, a multi-component .NET backdoor masquerading as benign utilities, to target government and military entities in Ukraine and Europe.
Bluekit PhaaS leverages advanced Browser-in-the-Middle (BitM) techniques and AI to bypass MFA by streaming live DOM interactions to victims.
A sophisticated AiTM phishing campaign utilizes the PoisonSeeds kit to harvest AWS console credentials and bypass MFA via real-time challenge relaying.
Vulnerabilities in Microsoft Graph API allow attackers to bypass Conditional Access policies and escalate token privileges to enumerate entire Entra ID tenants using compromised credentials.
An active phishing campaign targets hospitality organizations in Europe and Asia using photo-themed ZIP files to deliver a Node.js-based implant called TonRAT.
Threat actor abdrizak uses typosquatted npm packages like postcss-minify-selector-parser to deliver a multi-stage Windows RAT targeting developer environments.
The Miasma worm campaign compromised 20 LeoPlatform npm packages and a Verana Blockchain Go module to deploy a Bun-based credential stealer targeting developer environments and CI/CD pipelines.
