Browse public community intelligence reports, source analysis, and threat research.
247 intel reports
pyCodeV3 is a multi-stage Python loader using dynamic domain generation and pickle deserialization to execute arbitrary code from C2 servers.
The Aeternum botnet utilizes the public Polygon blockchain as a decentralized command-and-control infrastructure to distribute XWorm, XMRig, and data-stealing payloads.
The ClickFix EtherHiding campaign leverages compromised WordPress sites to deliver malware by retrieving stage-two payloads from Ethereum smart contracts.
Adversaries may use GenAI coding agents like Claude Code as trusted parents to deploy reverse tunnels, steal credentials, and establish LaunchAgent persistence on macOS.
Russian-linked DOUBLECUP Loader-as-a-Service facilitates ClickFix campaigns delivering CountLoader and a new blockchain-resolving RAT named DeviceManager.
A sophisticated macOS ClickFix campaign is now using server-side browser-fingerprinting gates to deliver infostealers like AMOS and MacSync only to genuine macOS environments.
Adversaries compromised maintainer accounts and CI/CD pipelines to distribute trojanized PyPI and npm packages targeting quantum computing researchers and Alibaba developers.
Storm-2945 utilizes a macOS ClickFix social engineering campaign to deliver Atomic Stealer and MacSync malware through sophisticated server-side browser-fingerprinting gates.
A state-sponsored threat group and Gunra ransomware actors exploited vulnerabilities in South Korean financial security software like AnySign4PC to deploy SIGNBT and COPPERHEDGE backdoors via watering holes.
North Korean threat actors compromised two @joyfill npm packages to deliver the DEV#POPPER RAT and OmniStealer via a multi-chain blockchain C2 infrastructure.
