Browse public community intelligence reports, source analysis, and threat research.
367 intel reports
The SC WordPress malware utilizes a redundant eight-component mesh across files, databases, and shared memory to self-heal and communicate via Ethereum blockchain gateways.
A suspected China-based threat actor exploited file upload vulnerabilities in a recreation management platform to deploy webshells and steal payment card data.
Water Hydra (EvilNum) has transitioned from complex zero-day exploits to social engineering-driven campaigns using .PIF files and non-standard protocol handlers to deliver the DarkMe RAT.
An intrusion campaign utilizing SEO poisoning delivers PavokwiLoader and RMMCRAT, employing advanced obfuscation and environment gating to deploy Cobalt Strike beacons.
Russian-branded ClickFix campaigns are compromising Ukrainian websites to deliver the Psychedelic infostealer and persistent remote access tools using fake CAPTCHA lures.
The MacSync family has evolved from AppleScript-based AMOS variants into a complex multi-stage binary infection chain targeting macOS users and developers to steal crypto and credentials.
A North Korean-linked operation targeted the npm registry using the GHAPPIER loader to establish persistence and remote access via compromised developer credentials.
Sauron Loader is a novel Russian-language Malware-as-a-Service that utilizes social engineering, DLL side-loading, and in-memory decryption to deliver multi-stage payloads.
Threat actors utilized fraudulent Google Ads and dynamic Vercel redirects to target Ledger hardware wallet users, aiming to steal secret recovery phrases through a sophisticated phishing chain.
Kothamine Agent is a C/C++ remote access Trojan distributed via malicious npm packages that leverages Tailscale’s tailcat tool for encrypted C2 communication to bypass network detection.
