Browse public community intelligence reports, source analysis, and threat research.
88 intel reports
Attackers compromised Adform's advertising tracking script trackpoint-async.js to replace cryptocurrency wallet addresses in user clipboards and web forms.
Russia-aligned actor TA488 is leveraging a critical XSS vulnerability in Outlook Web Access to deploy OWAReaper, a sophisticated browser-based implant for persistent mailbox access.
The Astaroth (Guildma) banking trojan has integrated a new browser-automated WhatsApp Web spambot to propagate malware through trusted social contacts, primarily targeting Brazilian users.
The Chaos ransomware group is using a new Rust-based RAT called msaRAT that establishes covert C2 channels by hijacking headless Chrome and Edge browsers via the Chrome DevTools Protocol.
The PhantomEnigma campaign leverages compromised Brazilian .gov.br infrastructure to deliver a modular Node.js backdoor aimed at banking credential theft.
Unauthenticated attackers can achieve remote code execution in ServiceNow AI Platform by escaping a script sandbox through a pre-authentication endpoint and gadget chain.
A global campaign uses heavily obfuscated JScript and AutoIt/Lua-based loaders disguised as .ttf files to deploy multiple RATs and infostealers via fileless execution.
Anonymous researcher 'bikini' released Exploitarium, a repository containing over 30 proof-of-concept exploits for unpatched vulnerabilities across multiple software projects, including critical flaws in libssh2 and Gitea.
The SuccessKey threat actor is targeting Vite ecosystem developers using malicious scoped npm packages that deliver a Remote Access Trojan (RAT) via a multi-tier blockchain C2 infrastructure.
DPRK-aligned threat actors are targeting developers with fake coding interviews that deliver OTTERCOOKIE malware via SVG-based steganography.
