Browse public community intelligence reports, source analysis, and threat research.
81 intel reports
A critical argument injection vulnerability in Gogs allows authenticated users to achieve RCE by injecting the --exec flag into git rebase during pull request operations.
The threat actor Mr_Rot13 is exploiting a critical cPanel authentication bypass (CVE-2026-41940) to deploy Go-based infectors and the 'filemanager' remote access trojan.
An unknown threat actor is exploiting a critical cPanel authentication bypass (CVE-2026-41940) to target South-East Asian military and government entities for data exfiltration and persistent network access.
A Qilin ransomware affiliate is targeting WatchGuard and Fortinet appliances using multiple CVEs to deploy Sliver C2 and establish reverse SOCKS tunnels into internal networks.
MiniRAT is a Go-based macOS remote access trojan delivered via the compromised velora-dex-sdk npm package, utilizing LaunchAgent persistence and AES-encrypted C2 configurations.
Threat actor 0xFFF (aka alh1mik) has released notnullOSX, a modular Go-based macOS stealer and backdoor targeting high-value cryptocurrency users through ClickFix social engineering.
Canis C2 is a previously undocumented cross-platform surveillance framework targeting Japanese users with sophisticated mobile agents and OS-specific fingerprinting.
The threat actor UAT-10608 is leveraging the React2Shell (CVE-2025-55182) vulnerability to deploy an automated framework that harvests credentials, SSH keys, and cloud tokens from Next.js applications.
A widespread initial access campaign using fraudulent human-verification prompts to trick victims into executing malicious commands via native system tools.
Attackers weaponized an unauthenticated RCE in Langflow within 20 hours of disclosure to exfiltrate credentials and deploy second-stage payloads.
