Browse public community intelligence reports, source analysis, and threat research.
102 intel reports
State-sponsored and cybercriminal actors are utilizing ClickFix Payload-as-a-Service (CPaaS) to deliver dynamically obfuscated malware via fake CAPTCHA social engineering and stealthy clipboard injection.
Remcos RAT is a sophisticated Windows remote access trojan used by actors like APT33 and UAC-0050 for extensive surveillance, credential theft, and full system control.
The Trum3it campaign utilizes a fake Polymarket arbitrage bot and 42 malicious npm packages to deliver an infostealer targeting DeFi developer credentials and crypto wallets.
The HellCat ransomware group is increasingly exploiting Jira credentials harvested by infostealers like StealC and Amadey to facilitate corporate breaches and data exfiltration.
A remote code execution vulnerability in Peyara Remote Mouse 1.0.1 allows unauthenticated attackers to execute arbitrary commands by sending simulated keyboard events via WebSockets.
The VEIL#DROP framework utilizes Google's Blogspot platform and living-off-the-land binaries to deploy the PureLog Stealer in memory via a multi-stage fileless chain.
Mustang Panda targets Indian government and energy sectors using novel ZOHOMURK and MINIRECON implants delivered via DLL sideloading and cloud-based C2.
An unidentified threat actor is targeting Thailand's healthcare sector using healthcare-themed lures to deploy a Python-based information stealer via multi-stage batch scripts.
The Gentlemen Ransomware-as-a-Service (RaaS) group utilizes a sophisticated EDR-killing framework and targets global organizations using leaked Fortinet VPN credentials.
The APT37 group is targeting South Korean users with NarwhalRAT, a multi-stage Python backdoor delivered via Microsoft-themed phishing and utilizing pCloud as a dead-drop resolver.
