Browse public community intelligence reports, source analysis, and threat research.
306 intel reports
A trojanized version (2.1.313) of the Anthropic Claude Code VS Code extension plants a persistent SSH reverse tunnel and performs host reconnaissance.
The Shai-Hulud worm compromised the tensorlake npm package to exfiltrate secrets and cryptocurrency browser data while implementing a destructive 'dead-man's switch' upon token revocation.
The n0n ransomware group utilizes AI coding agents and credential-based access to target global organizations, frequently destroying data and backups when encryption is not feasible.
DPRK-linked actors are utilizing ErrTraffic ClickFix lures on compromised WordPress sites alongside fake recruiter personas to deliver Node.js-based RATs with Polygon-hosted C2 resolvers.
Affiliates of INC and The Gentlemen ransomware groups are using an AI-orchestrated infrastructure featuring the 'Phantom' autonomous red team framework to exploit edge devices and deploy ransomware.
An SEO poisoning campaign utilizes fake Chocolatey and Microsoft Activation Scripts websites to deliver Armorsteal, a modular Python-based stealer and remote access tool.
C2Agent is a sophisticated Go-based Windows malware that utilizes Large Language Models (LLMs) and the Model Context Protocol (MCP) to interactively drive post-exploitation activities.
Adversary c05d5254 uses the PoisonedRefresh rootkit to inject fileless PHP web shells into F5 BIG-IP APM memory via CVE-2025-53521 exploitation.
Kimsuky (APT-C-55) utilizes phishing emails with malicious LNK files and supply-chain poisoning of the 'pybroker' library to steal sensitive data from financial and research sectors.
CrocoRat is a Python-based remote access trojan and cryptocurrency stealer delivered via ClickFix social engineering and novel DNS TXT record payload staging.
