Browse public community intelligence reports, source analysis, and threat research.
277 intel reports
The InstallFix campaign utilizes Google Ads and fake Claude AI installation pages to deliver RedLine Stealer through a complex, multi-stage infection chain.
A Chinese-speaking threat actor compromised DAEMON Tools installers to deploy information collectors, minimalistic backdoors, and the complex QUIC RAT against targeted organizations.
The threat actor STAC6405 is conducting an ongoing phishing campaign targeting U.S. organizations with a dual-RMM architecture using SimpleHelp and ScreenConnect for persistent, silent access.
VECT 2.0 ransomware permanently destroys data in files larger than 128 KB due to a critical nonce-handling flaw across Windows, Linux, and ESXi platforms.
The TeamPCP campaign hijacked the @bitwarden/cli npm package to distribute a sophisticated stealer targeting developer credentials, cloud secrets, and AI configuration files.
The Mini Shai-Hulud malware targets SAP npm packages to steal developer and cloud credentials using an obfuscated Bun-based execution framework.
The Shai Hulud threat actor compromised SAP CAP framework packages by exploiting an AI coding assistant's GitHub integration to inject malicious code and steal npm OIDC tokens.
Silver Fox threat group utilizes tax-themed phishing to deploy a modified RustSL loader, ValleyRAT, and a new Python-based backdoor named ABCDoor against organizations in Russia and India.
TeamPCP executed a supply chain attack on the elementary-data PyPI package using GitHub Actions injection to distribute a credential-stealing payload targeting data engineers.
Threat actors compromised the Axios npm package to deliver a multi-platform Remote Access Trojan (RAT) via the malicious dependency 'plain-crypto-js'.
