Browse public community intelligence reports, source analysis, and threat research.
75 intel reports
Egyptian threat actor codemado and associates leverage custom Evilginx forks and Device Code Flow abuse to target Microsoft 365 and cryptocurrency users.
The Kali365 phishing kit abuses Microsoft and Google device code authentication flows to steal OAuth access tokens from US organizations across multiple sectors.
TELEPUZ is a full-featured modular malware spreading through CLICKFIX social engineering and VIDAR stealer, featuring advanced evasion and dead-drop resolver techniques.
A sophisticated supply chain attack compromised the AsyncAPI npm organization to distribute the Miasma multi-stage dropper, targeting developers for credential theft and lateral movement.
ClickLock Dev uses ClickFix social engineering and aggressive process-killing loops to steal credentials and crypto wallets from macOS users in Europe and North America.
Threat actors are using vishing and Microsoft Teams screen-sharing to impersonate corporate IT support and deploy the blockchain-anchored EtherRAT malware.
Turla (Secret Blizzard) targets government and military entities globally using the custom STOCKSTAY and Kazuar backdoors, often leveraging hijacked infrastructure.
ClickFix campaigns utilize fake Google and Cloudflare verification pages to trick users into executing PowerShell commands that deliver loaders like ResiLoader and various stealers.
A malicious Chromium extension impersonates Perplexity AI to intercept search queries and capture real-time keystrokes using browser-native APIs and typosquatted infrastructure.
The Shai-Hulud worm and GitRunner C2 framework abuse legitimate, digitally signed GitLab CI runner binaries as persistent backdoors to execute commands via CI/CD pipelines.
