Browse public community intelligence reports, source analysis, and threat research.
367 intel reports
North Korean threat actor NICKEL ALLEY is targeting tech professionals via fake job interviews to deliver PyLangGhost RAT and BeaverTail malware through social engineering and malicious GitHub repositories.
Multiple China-aligned threat actors, including Stately Taurus and clusters CL-STA-1048/1049, are targeting a Southeast Asian government using a diverse toolkit of USB-propagated malware, novel loaders, and remote access Trojans.
Threat actor TeamPCP compromised the Trivy vulnerability scanner and associated GitHub Actions to exfiltrate cloud and CI/CD credentials via poisoned tags and binaries.
A widespread initial access campaign using fraudulent human-verification prompts to trick victims into executing malicious commands via native system tools.
Attackers weaponized an unauthenticated RCE in Langflow within 20 hours of disclosure to exfiltrate credentials and deploy second-stage payloads.
A sophisticated PureLog Stealer campaign uses localized copyright violation lures and a multi-stage, fileless execution chain to target multiple global sectors.
The threat actor TeamPCP compromised Aqua Security's Trivy project, injecting credential-stealing malware into official releases and forcing malicious updates to GitHub Actions.
