Browse public community intelligence reports, source analysis, and threat research.
1,183 intel reports
An invoice fraud campaign uses legitimate Upflow.io tokens and spoofed subdomains to bypass authentication and capture payments via fraudulent IBANs.
An unidentified threat actor is using the VAPT offensive framework to hijack misconfigured Ollama AI servers for automated vulnerability scanning, exploit generation, and credential theft.
Threat actors are utilizing VHDX disk images to deliver Remcos RAT through a multi-stage process involving WMI execution and reflective .NET loading to bypass security controls.
The GLASSWORM threat actor is deploying trojanized Open VSX extensions using TinyGo-compiled WebAssembly loaders that leverage Solana blockchain memos for C2 infrastructure resolution.
Attackers leverage the Windows Distributed Component Object Model (DCOM) to execute remote commands via trusted binaries like mmc.exe and excel.exe.
An attacker compromised the CDN API keys of OptinMonster, TrustPulse, and PushEngage to serve tampered JavaScript that creates rogue admin accounts on customer sites.
The Phantom Stealer campaign targets banks and high-value organizations using fileless techniques and a layered dropper to exfiltrate browser credentials and financial data.
A critical pre-authentication vulnerability in Splunk's PostgreSQL Sidecar Service allows unauthenticated attackers to achieve remote code execution through chained exploitation of path traversal and unsafe database parameters.
A critical vulnerability chain named SearchLeak allows attackers to exfiltrate sensitive Microsoft 365 data via a single-click URL exploit targeting Copilot Enterprise Search.
Authenticated attackers can exploit a path traversal vulnerability in SharePoint's Upload.aspx to upload ASPX webshells and achieve remote code execution.
