Browse public community intelligence reports, source analysis, and threat research.
113 intel reports
Apex Foundation is distributing a macOS infostealer via npm packages and a fake MCP server, targeting Web3 founders with an AI-advisor lure.
Kimsuky targeted South Korean groupware vendors to compromise downstream customers using new Gomir malware variants and credential harvesting techniques.
UNC-RAID-M8280 uses a cross-platform Rust loader to deploy a customized Sliver C2 implant via abused third-party cloud storage and Cloudflare Tunnel infrastructure.
TELEPUZ is a full-featured modular malware spreading through CLICKFIX social engineering and VIDAR stealer, featuring advanced evasion and dead-drop resolver techniques.
DPRK-aligned threat actors are targeting developers with fake coding interviews that deliver OTTERCOOKIE malware via SVG-based steganography.
A suspected North Korean cluster, linked to Sapphire Sleet, uses AppleScript to bypass macOS TCC protections and deploy the ptApp backdoor targeting cryptocurrency organizations.
NadMesh is an autonomous, Go-based botnet designed to harvest AI service credentials and exploit infrastructure including Docker, Kubernetes, and Model Context Protocol (MCP) services.
The MemGhost framework automates stealth memory injection into persistent AI agents like OpenClaw, enabling long-term compromise via a single adversarial email.
An unknown Chinese-speaking APT group is targeting Russian critical sectors by exploiting the ViPNet update system to deploy a suite of malicious modules including HelloInjector and HelloProxy.
The threat actor Hyadina has rebranded Beast ransomware as GodDamn, utilizing the malicious PoisonX kernel driver to disable endpoint defenses via BYOVD attacks.
