Browse public community intelligence reports, source analysis, and threat research.
1,186 intel reports
Researchers identified a technique where attackers can redirect cloud data streams by deleting a target storage bucket and recreating it in an attacker-controlled account using the same globally unique name.
Researchers from AIR created a fake AI agent skill named brand-landingpage that bypassed multiple security scanners to reach 26,000 agents by hosting malicious instructions on an external domain.
An actor published 15 npm packages using 13 throwaway scopes to deliver a multi-stage Rust-compiled infostealer targeting developer and crypto credentials.
An unidentified threat actor is targeting Thailand's healthcare sector using healthcare-themed lures to deploy a Python-based information stealer via multi-stage batch scripts.
Threat actors are weaponizing the OpenClaw AI agent ecosystem by publishing malicious skills on ClawHub that deliver infostealers and execute novel agentic financial fraud.
An unidentified threat actor used ClickFix social engineering to deploy Potemkin Loader and RMMProject, moving laterally via SMBExec to distribute EtherRAT across 11 hosts.
DPRK-aligned actors are deploying macOS.Gaslight, a Rust-based backdoor that utilizes prompt injection payloads to subvert LLM-assisted malware analysis pipelines.
The Gentlemen Ransomware-as-a-Service (RaaS) group utilizes a sophisticated EDR-killing framework and targets global organizations using leaked Fortinet VPN credentials.
The ShinyHunters extortion group (UNC6240) is exploiting a critical remote code execution zero-day in Oracle PeopleSoft to breach over 100 organizations, primarily in the education sector.
Pony is a long-standing credential stealer and downloader that targets various applications and uses dictionary attacks against local Windows accounts to deliver second-stage payloads like ZeuS.
