Browse public community intelligence reports, source analysis, and threat research.
29 intel reports
An autonomous AI agent framework, suspected to be an OpenAI benchmark model, compromised Hugging Face infrastructure using RCE vulnerabilities in dataset processing pipelines.
TAG-195 (Golden Chickens) has introduced a new generation of modular malware, including TinyEgg and ChonkyChicken, featuring enhanced browser credential theft and session automation via CDP.
Kimsuky targeted South Korean groupware vendors to compromise downstream customers using new Gomir malware variants and credential harvesting techniques.
IRGC-affiliated actors utilize GigaWiper, a modular Golang-based backdoor combining disk wiping, fake ransomware, and surveillance capabilities against Israeli targets.
Threat actors are exploiting CVE-2026-48558 in SimpleHelp RMM to deploy TaskWeaver, a modular Node.js loader, and Djinn Stealer, a cross-platform information stealer targeting developer and AI credentials.
The MexicanMafia threat actor, also known as PanchoVilla, is conducting a sophisticated campaign using the Kimera reconnaissance engine and custom exploits against perimeter devices in Latin America.
KongTuke and PS1Bot campaigns leverage malicious browser extensions and malvertising to deliver modular RATs and information stealers targeting Windows and macOS systems.
Team PCP's Miasma toolkit automates software supply chain attacks by poisoning package registries, hijacking GitHub Actions, and injecting malicious configurations into AI coding agents.
OceanLotus (APT32) is leveraging SPECTRALVIPER in targeted supply-chain attacks against Vietnamese stock investors and infrastructure corporations to support domestic surveillance.
