Browse public community intelligence reports, source analysis, and threat research.
72 intel reports
A new macOS ClickFix campaign uses social engineering to trick users into running Terminal commands that silently mount DMGs and execute the Atomic macOS Stealer (AMOS).
A Russian-speaking attacker is deploying the Meow AppleScript RAT via ClickFix social engineering lures to exfiltrate data and hijack cryptocurrency wallets on macOS.
The MexicanMafia threat actor, also known as PanchoVilla, is conducting a sophisticated campaign using the Kimera reconnaissance engine and custom exploits against perimeter devices in Latin America.
The GreatXML exploit by researcher Nightmare-Eclipse abuses the Windows Recovery Environment and Defender Offline Scan state to bypass BitLocker encryption using a malicious unattend.xml file.
DirtyFrag is a sophisticated Linux kernel Local Privilege Escalation toolkit that uses page cache corruption and RxRPC/AF_ALG abuse to gain root access.
Threat actor SheldIO is deploying Amatera Stealer 4.0.2 via the EVALUSION campaign, featuring advanced evasion techniques and significantly expanded targeting for cryptocurrency wallets and messaging apps.
An unknown threat actor is exploiting a critical cPanel authentication bypass (CVE-2026-41940) to target South-East Asian military and government entities for data exfiltration and persistent network access.
A Qilin ransomware affiliate is targeting WatchGuard and Fortinet appliances using multiple CVEs to deploy Sliver C2 and establish reverse SOCKS tunnels into internal networks.
NVIDIA's NemoClaw sandbox environment is vulnerable to data exfiltration and configuration poisoning via weaponized authorized tools and emoji-based evasion.
Threat actor 0xFFF (aka alh1mik) has released notnullOSX, a modular Go-based macOS stealer and backdoor targeting high-value cryptocurrency users through ClickFix social engineering.
