Browse public community intelligence reports, source analysis, and threat research.
88 intel reports
Threat actors are exploiting CVE-2026-48558 in SimpleHelp RMM software to deploy TaskWeaver and Djinn Stealer, targeting cloud, AI, and developer credentials across Windows, macOS, and Linux.
Lazarus-linked North Korean actors are targeting software developers via hijacked npm/Go packages and fraudulent job interviews to deploy the InvisibleFerret infostealer.
Threat actors are exploiting CVE-2026-48558 in SimpleHelp RMM to deploy TaskWeaver, a modular Node.js loader, and Djinn Stealer, a cross-platform information stealer targeting developer and AI credentials.
An active phishing campaign targets hospitality organizations in Europe and Asia using photo-themed ZIP files to deliver a Node.js-based implant called TonRAT.
The Miasma worm campaign compromised 20 LeoPlatform npm packages and a Verana Blockchain Go module to deploy a Bun-based credential stealer targeting developer environments and CI/CD pipelines.
The MexicanMafia threat actor, also known as PanchoVilla, is conducting a sophisticated campaign using the Kimera reconnaissance engine and custom exploits against perimeter devices in Latin America.
The AutoJack exploit chain leverages a confused deputy browsing agent to bypass localhost trust boundaries and achieve RCE in Microsoft's AutoGen Studio.
The Mastra AI framework suffered a supply chain attack involving over 140 compromised npm packages that deliver a cross-platform infostealer via a typosquatted dependency.
Attacker sergey2016 compromised the @mastra npm organization to inject the easy-day-js typosquat dependency, delivering an obfuscated postinstall dropper.
KongTuke and PS1Bot campaigns leverage malicious browser extensions and malvertising to deliver modular RATs and information stealers targeting Windows and macOS systems.
