Browse public community intelligence reports, source analysis, and threat research.
368 intel reports
Threat actor abdrizak uses typosquatted npm packages like postcss-minify-selector-parser to deliver a multi-stage Windows RAT targeting developer environments.
Initial Access Broker Woodgnat (KongTuke) is deploying the Mistic and MLTBackdoor RATs via social engineering and compromised WordPress sites to sell network access to major ransomware affiliates.
A cryptocurrency-mining campaign exploits CVE-2026-33017, an unauthenticated RCE in Langflow, to deploy a Go-based miner with aggressive defense evasion and lateral movement capabilities.
Threat actors are weaponizing the OpenClaw AI agent ecosystem by publishing malicious skills on ClawHub that deliver infostealers and execute novel agentic financial fraud.
DPRK-aligned actors are deploying macOS.Gaslight, a Rust-based backdoor that utilizes prompt injection payloads to subvert LLM-assisted malware analysis pipelines.
The ShinyHunters extortion group (UNC6240) is exploiting a critical remote code execution zero-day in Oracle PeopleSoft to breach over 100 organizations, primarily in the education sector.
Pony is a long-standing credential stealer and downloader that targets various applications and uses dictionary attacks against local Windows accounts to deliver second-stage payloads like ZeuS.
The Drun Backdoor is a modular two-stage infostealer that utilizes the Chromelevator loader to inject into processes via direct syscalls, targeting browser credentials, session tokens, and gaming accounts.
A threat actor known as Poisson utilized Havoc C2 and Tailscale VPN to establish persistent, secondary access into French automotive and individual targets for credential theft.
The MexicanMafia threat actor, also known as PanchoVilla, is conducting a sophisticated campaign using the Kimera reconnaissance engine and custom exploits against perimeter devices in Latin America.
