Browse public community intelligence reports, source analysis, and threat research.
367 intel reports
The Phexia threat actor uses fake CAPTCHA 'ClickFix' lures to deploy a macOS backdoor that resolves its C2 hostname via a Polygon smart contract and drops multiple infostealers.
The Gentlemen threat actor group is utilizing the cross-platform TukTuk C2 framework and BYOVD techniques to neutralize EDR solutions while targeting global technology and healthcare sectors.
The North Korean threat actor Jade Sleet (TraderTraitor) is targeting DevOps engineers at IT services firms using weaponized Terraform coding projects and macOS backdoors FLATROOF and ROOFDECK.
Atomic macOS Stealer (AMOS) is being delivered via a sophisticated ClickFix attack chain that uses a deceptive Xcode download site to trick users into executing malicious Terminal commands.
The threat actor Larva-25012 is utilizing the DPLoader malware to distribute various Proxyware SDKs like DigitalPulse and SOAX to monetize infected systems' bandwidth.
An unidentified threat actor published malicious npm packages posing as Twilio security research tools to exfiltrate sensitive API credentials and system metadata.
Threat actors registered the common documentation placeholder third-party[.]com to serve ClickFix social engineering lures that trick Windows users into executing malicious PowerShell commands.
PamStealer targets macOS users via fake 'Wavel' crypto wallet lures, utilizing a novel live server-side decryption utility (pkgunpack) and a Swift-based infostealer payload.
The SideCopy APT is targeting Indian academic institutions using weaponized LNK files and mshta.exe to deploy ReverseRAT via fileless .NET deserialization.
Chinese threat actors UTA0560 and JungleBamboo exploited a 'patch-gap' zero-day chain in Chrome and Windows to deploy the GRIMWEDGE backdoor and LONGTALE credential stealer.
