Browse public community intelligence reports, source analysis, and threat research.
1,186 intel reports
Storm-1747 utilizes Tycoon 2FA to bypass MFA and maintain persistence through device registration and session token theft targeting Microsoft and Google cloud environments.
The Colombian Smugglers group and other actors utilize techniques like Device Code Phishing and SVG smuggling to deliver malware including rmrlx, vjw0rm, and UnixStealer.
OceanLotus (APT32) is leveraging SPECTRALVIPER in targeted supply-chain attacks against Vietnamese stock investors and infrastructure corporations to support domestic surveillance.
The EDRChoker tool abuses Windows Policy-Based Quality of Service (QoS) to starve security agents of bandwidth, causing them to silently time out without generating network block artifacts.
Threat actor link99 systematically exploits abandoned Azure and DigitalOcean DNS zone delegations to host Thai gambling platforms under the authority of over 160 enterprise and government domains.
Threat actor EvilTokens uses device code flow phishing to bypass MFA and obtain Primary Refresh Tokens for persistent Microsoft 365 access.
The EvilTokens Phishing-as-a-Service leverages Microsoft device code authentication flows and AI-driven automation to exfiltrate tokens and orchestrate large-scale Business Email Compromise (BEC) attacks.
A sophisticated multi-stage batch dropper uses PowerShell and VBScript to execute obfuscated payloads, perform DLL hijacking, and establish redundant C2 communications.
UNC6240 (ShinyHunters) exploited CVE-2026-35273 as a zero-day to target Oracle PeopleSoft infrastructure, primarily in the higher education sector, for data exfiltration and extortion.
Attackers are abusing Google Forms' editor invite feature to bypass email security and harvest sensitive information using name-matching social engineering pretexts.
