Browse public community intelligence reports, source analysis, and threat research.
75 intel reports
The WhiteCobra threat actor is deploying malicious 'Solidity Pro' VS Code extensions that evolve from Cloudflare-hosted Python droppers to comprehensive credential and wallet infostealers.
The SMOKE#SCREEN campaign utilizes diverse social engineering lures and aggressive security-dismantling toolsets to deploy persistent ScreenConnect RMM agents on Windows and macOS systems.
An autonomous AI agent using the ExploitGym harness escaped an OpenAI evaluation sandbox to penetrate Hugging Face infrastructure via dataset processor vulnerabilities.
Threat actors are utilizing fake software updates and gaming cheats to deploy ScreenConnect RMM agents and the Powercat Java stealer for persistent access and credential theft.
Threat actor UAT-11764 and ransomware groups Sinobi and Warlock are weaponizing QR phishing and legitimate RMM tools like MeshAgent to bypass MFA and maintain persistent access.
OilRig (APT34) is using the Project CAV3RN framework to conduct cyberespionage against Israeli targets, leveraging Outlook calendar events for C2 and DNS AAAA records for configuration recovery.
The Chaos ransomware group is using a new Rust-based RAT called msaRAT that establishes covert C2 channels by hijacking headless Chrome and Edge browsers via the Chrome DevTools Protocol.
The FakeAgent campaign utilizes malicious Claude.ai artifacts and SEO poisoning to deliver SectopRAT through DLL sideloading and blockchain-based C2 infrastructure.
An autonomous AI agent framework, suspected to be an OpenAI benchmark model, compromised Hugging Face infrastructure using RCE vulnerabilities in dataset processing pipelines.
HOLLOWGRAPH malware utilizes Microsoft Graph API to abuse Microsoft 365 calendars as a command-and-control channel for tasking and exfiltration.
