Browse public community intelligence reports, source analysis, and threat research.
124 intel reports
DPRK-nexus actors, likely Sapphire Sleet, leveraged malicious Rust packages on crates.io to deploy Rustbot, a macOS RAT targeting cloud credentials and cryptocurrency wallets.
An unauthenticated second-order SQL injection vulnerability in the All-in-One WP Migration and Backup plugin (CVE-2026-19949) enables remote code execution through malicious WordPress trackbacks and archive restoration.
Zhibotong (ZBT) electronics routers and white-labeled variants contain multiple pre-installed surveillance implants enabling unauthenticated root access, DNS hijacking, and credential exfiltration.
The Dark Caracal threat actor is deploying a modular Go-based framework named GoCaracal that utilizes Ethereum smart contracts for resilient command-and-control infrastructure.
ChainDrop, a descendant of the Shai-Hulud malware family, is a self-propagating npm worm targeting developer workstations and CI/CD pipelines to harvest cloud, registry, and AI tool credentials.
ToxNetV2 is an AArch64 Linux P2P botnet that integrates NVIDIA NIM LLM services into its controller's decision-making loop to propose operational actions.
An attacker can exfiltrate sensitive local data from Amazon Kiro IDE by using malicious repository content to influence the AI agent into modifying configuration settings and triggering outbound network requests.
Sapphire Sleet (DPRK) compromised popular Rust crates including arrayref and append-only-vec by injecting a malicious typosquatted dependency, proc-macro1, to execute a second-stage backdoor at build time.
Wiz Red Agent discovered a script injection vulnerability in Snowflake's GitHub Actions workflow, potentially introduced by AI, enabling Jira credential exfiltration.
An unidentified threat actor deployed a custom 12 KB Windows backdoor that hides its C2 domain using unary-encoded whitespace within a spoofed desktop.ini file.
