Browse public community intelligence reports, source analysis, and threat research.
124 intel reports
Researchers discovered multiple critical memory corruption vulnerabilities in Zoom's annotation feature that enable zero-click remote code execution on all meeting participants.
China-based Jewelbug APT utilizes the XG-Web platform to conduct dual-mission operations involving government espionage across the Middle East and Asia alongside large-scale cryptocurrency fraud.
An unidentified operator deployed 28 malicious 'evil-twin' Open VSX extensions that exfiltrate developer environment data to i.apee.my.id using multiple network evasion techniques.
Outsider Enterprise utilizes the JWR phishing framework, a variant of The Outsider, to perform real-time credential and PII theft through SMS lures and encrypted WebSockets.
Kynx is a C++ infostealer developed with AI assistance that targets browser credentials, crypto wallets, gaming platforms, and AI coding assistants like Claude and Cursor.
Gunra is a Conti-derived ransomware-as-a-service (RaaS) targeting global critical infrastructure using double-extortion and cross-platform encryptors.
China-based APT Jewelbug conducts simultaneous government espionage across the Middle East and Asia alongside industrial-scale cryptocurrency fraud using a unified C2 framework.
Adversaries may use GenAI coding agents like Claude Code as trusted parents to deploy reverse tunnels, steal credentials, and establish LaunchAgent persistence on macOS.
Russian-linked DOUBLECUP Loader-as-a-Service facilitates ClickFix campaigns delivering CountLoader and a new blockchain-resolving RAT named DeviceManager.
A sophisticated macOS ClickFix campaign is now using server-side browser-fingerprinting gates to deliver infostealers like AMOS and MacSync only to genuine macOS environments.
