Browse public community intelligence reports, source analysis, and threat research.
277 intel reports
The TeamPCP threat group is conducting a large-scale supply chain campaign using the 'Mini Shai-Hulud' worm to compromise npm packages, steal CI/CD and cloud credentials, and autonomously propagate.
JS.MonoGlyphRAT is a persistent JScript backdoor targeting US technology, MSSP, and telecom sectors using monoglyph-obfuscated scripts and encrypted PowerShell stagers.
The threat actor UAC-0184 is targeting Ukrainian Defense Forces using gated HTA delivery methods and complex DLL sideloading chains that culminate in the repurposing of legitimate, signed network utilities.
Financially motivated actors are using SEO poisoning to impersonate AI tools like Gemini and Claude Code, delivering a fileless PowerShell infostealer to developer workstations.
The Mini Shai-Hulud worm was deployed via compromised @antv npm packages to exfiltrate developer secrets and propagate to other repositories.
TamperedChef clusters leverage trojanized productivity software distributed via malvertising to deliver infostealers, RATs, and browser hijackers.
Chinese-speaking threat actor lwxat operates a Malware-as-a-Service (MaaS) ecosystem centered on BadIIS, targeting web servers for SEO fraud and malicious redirection.
CountLoader uses multi-stage PowerShell and JavaScript execution via mshta.exe to deploy a cryptocurrency clipper that redirects transactions by hijacking clipboard data.
The KongTuke group is leveraging Microsoft Teams social engineering to deploy ModeloRAT, escalate privileges via CVE-2023-36036, and harvest domain credentials using fake Windows lock screens.
Seedworm (MuddyWater) conducted a global espionage campaign in early 2026 using Node.js loaders and DLL sideloading to target manufacturing, government, and financial sectors.
