Browse public community intelligence reports, source analysis, and threat research.
368 intel reports
Unknown threat actors are exploiting CVE-2026-5426 in KnowledgeDeliver LMS using hardcoded machine keys to achieve RCE and deploy BLUEBEAM web shells and Cobalt Strike.
A new malware campaign dubbed Argamal targets players of adult games using trojanized installers to deliver a full-featured Remote Access Trojan (RAT).
UNC5342 utilizes the EtherHiding technique on the BNB Smart Chain testnet to host immutable ClearFake payload routing instructions targeting Windows and macOS users.
FAMOUS CHOLLIMA (DPRK) distributes the MicrosoftSystem64 RAT via malicious npm packages, leveraging HuggingFace for binary updates and data exfiltration.
BlackSuit affiliates use Microsoft Teams vishing and email bombing to deploy Nimbus RAT, a Java-based malware abusing Google Drive for C2.
The Weedhack Malware-as-a-Service (MaaS) campaign targets Minecraft players with custom JAR files that deploy multi-stage infostealers and RATs using Ethereum-based C2 infrastructure.
SilentCryptoMiner and XMRig variants are being distributed through pirated movie and digital library sites using fake video player updates and DLL side-loading.
JS.MonoGlyphRAT is a persistent JScript backdoor targeting US technology, MSSP, and telecom sectors using monoglyph-obfuscated scripts and encrypted PowerShell stagers.
The threat actor vpmdhaj published 14 malicious npm packages typosquatting OpenSearch and ElasticSearch libraries to harvest AWS, HashiCorp Vault, and GitHub Actions credentials.
Threat actors including Aeternum are exploiting CVE-2026-26980 in Ghost CMS to inject malicious JavaScript loaders that facilitate ClickFix social engineering attacks and malware delivery.
