Browse public community intelligence reports, source analysis, and threat research.
1,186 intel reports
A critical pre-authentication vulnerability in Splunk's PostgreSQL Sidecar Service allows unauthenticated attackers to achieve remote code execution through chained exploitation of path traversal and unsafe database parameters.
A critical vulnerability chain named SearchLeak allows attackers to exfiltrate sensitive Microsoft 365 data via a single-click URL exploit targeting Copilot Enterprise Search.
Authenticated attackers can exploit a path traversal vulnerability in SharePoint's Upload.aspx to upload ASPX webshells and achieve remote code execution.
The Storm-1747 threat actor uses the Tycoon 2FA AiTM phishing kit to bypass multi-factor authentication and maintain persistence in Microsoft 365 and Google Workspace environments.
A chain of three vulnerabilities in the LiteLLM AI gateway allows low-privilege users to bypass authorization, escalate to administrative privileges, and execute arbitrary code on the host server.
EtherRAT uses the Ethereum blockchain for resilient C2 infrastructure while distributing via malicious MSI and PowerShell loaders.
North Korea-aligned actors are targeting developers via phishing and malicious GitHub repositories using VS Code's 'runOn' features to deliver cross-platform malware.
Threat actors including BlackCat and STORM-0501 are leveraging native Azure features like Encryption Scopes and Customer-Provided Keys to encrypt and hold blob storage for ransom.
Amos Stealer targets macOS environments to harvest browser credentials, Apple Keychains, and developer configuration files using sophisticated AppleScript and shell script execution.
KongTuke and PS1Bot campaigns leverage malicious browser extensions and malvertising to deliver modular RATs and information stealers targeting Windows and macOS systems.
