Browse public community intelligence reports, source analysis, and threat research.
247 intel reports
The Atomic macOS Stealer (AMOS) campaign utilizes 'ClickFix' social engineering on Google Sites lures to trick users into executing malicious Terminal commands.
The gaiadeqi.com campaign utilizes highly obfuscated JavaScript droppers to deliver credential-stealing trojans disguised as VLC Media Player installers.
ChainDrop, a descendant of the Shai-Hulud malware family, is a self-propagating npm worm targeting developer workstations and CI/CD pipelines to harvest cloud, registry, and AI tool credentials.
Sapphire Sleet (DPRK) compromised popular Rust crates including arrayref and append-only-vec by injecting a malicious typosquatted dependency, proc-macro1, to execute a second-stage backdoor at build time.
Chinese-speaking threat actor UAT-10147 leverages agentic AI frameworks like PentestGPT and DeepAudit to automate reconnaissance and exploit validation against Windows and Linux web servers.
A suspected China-nexus actor, designated SilkParasite, utilizes a modular ecosystem of seven RAT families to target government economic bodies in Central Asia via DLL sideloading and Google Drive-backed C2.
The Mirage2FA Phishing-as-a-Service toolkit by LinX Coders utilizes Adversary-in-the-Middle (AiTM) techniques to bypass MFA and steal Microsoft 365 session cookies, primarily targeting US-based technology and manufacturing sectors.
C2Looper is a new Rust-based backdoor likely linked to ransomware actors, utilizing GitHub for command-and-control and distributed via ClickFix campaigns.
ACRStealer campaign leverages a legitimate, Microsoft-signed Korean DLP driver (DCRCVDrv.sys) to perform kernel-context process termination for security software suppression.
A multi-stage PureLogs Stealer campaign impersonates Adobe Sign to deliver fileless payloads via image steganography and environment variable manipulation.
