Browse public community intelligence reports, source analysis, and threat research.
218 intel reports
The Shai-Hulud worm compromised the tensorlake npm package to steal developer credentials, AI tool configurations, and implement a self-destruct mechanism triggered by token revocation.
The Shai-Hulud worm compromised the tensorlake npm package to exfiltrate secrets and cryptocurrency browser data while implementing a destructive 'dead-man's switch' upon token revocation.
A trojanized version (2.1.313) of the Anthropic Claude Code VS Code extension plants a persistent SSH reverse tunnel and performs host reconnaissance.
A suspected Chinese threat actor is using SEO poisoning targeting DeepSeek AI users to deliver Kong RAT through a complex multi-stage infection chain.
The n0n ransomware group utilizes AI coding agents and credential-based access to target global organizations, frequently destroying data and backups when encryption is not feasible.
Affiliates of INC and The Gentlemen ransomware groups are using an AI-orchestrated infrastructure featuring the 'Phantom' autonomous red team framework to exploit edge devices and deploy ransomware.
APT28 (Swallowtail) is executing a complex cyber espionage campaign targeting NATO naval and aerospace manufacturers using the Hookedge backdoor and a novel reflective loader.
An extensive phishing campaign impersonating the U.S. District Court targets over 100,000 companies using personalized lures to deliver the LodaRAT remote access trojan via malicious ISO files.
The Yoba campaign utilizes SEO-poisoned GitHub repositories and fake AI desktop applications to distribute a custom loader that delivers XMRig miners via DLL sideloading.
An SEO poisoning campaign utilizes fake Chocolatey and Microsoft Activation Scripts websites to deliver Armorsteal, a modular Python-based stealer and remote access tool.
