Browse public community intelligence reports, source analysis, and threat research.
108 intel reports
Threat actors abuse Microsoft Teams external chat to pose as IT support, using email bombing and vishing to deploy remote access tools and malware.
An operator exfiltrated over 68 GB of SQL Server backups from a Philippine government agency and staged a rebranded GodPotato tool named Wrqsnx on an open directory.
Affiliates of INC and The Gentlemen ransomware groups are using an AI-orchestrated infrastructure featuring the 'Phantom' autonomous red team framework to exploit edge devices and deploy ransomware.
Russian-speaking actors NyashTeam and Kapchenka operate Salat Stealer (WEB_RAT), a Go-based MaaS targeting Windows for credential and cryptocurrency theft.
The bonto.io campaign uses malicious Firefox extensions impersonating Phantom, Jupiter, and Bitget wallets to steal recovery phrases and private keys.
The TRUST#GRAFT campaign utilizes a browser-mediated JavaScript loader to hijack authenticated WordPress administrator sessions for the deployment of a persistent PHP backdoor.
Threat actors are using stolen UpdraftCentral connection keys to deploy malicious plugins and create administrator accounts on WordPress websites.
A malicious loader disguised as a Capacitor configuration file executes remote JavaScript by decoding an environment variable and masking failures as authentication errors.
The Ebury botnet hijacked over 300 Tor exit relays to perform Man-in-the-Middle (MitM) attacks on SSH traffic, capturing login credentials and installing further malware.
Threat actor TeamPCP executed a massive supply chain campaign compromising GitHub Actions from Aqua Security and Checkmarx, VS Code extensions, and npm packages to deploy a multi-stage credential stealer and a self-propagating worm.
