Browse public community intelligence reports, source analysis, and threat research.
247 intel reports
The Veil#Drop framework utilizes a multi-stage infection chain involving JavaScript launchers and PowerShell cradles hosted on Blogspot to deploy PureLog Stealer in memory.
A threat actor compromised a Mastra maintainer account to poison 140+ npm packages with a malicious dependency used for cross-platform backdoors and credential exfiltration.
Armored Likho targets government and energy sectors in Russia, Brazil, and Kazakhstan using BusySnake Stealer, a Python-based infostealer distributed via AI-generated loaders and LNK files.
ClickFix campaigns utilize fake Google and Cloudflare verification pages to trick users into executing PowerShell commands that deliver loaders like ResiLoader and various stealers.
Kimsuky (APT43) utilizes a multi-stage CHM-based execution chain to profile systems and selectively deliver follow-on PowerShell payloads to targeted hosts.
The Millenium RAT has evolved into a native C++ application used by Y2K Operators to compromise over 62,000 global targets via Telegram-based command and control.
State-sponsored and cybercriminal actors are utilizing ClickFix Payload-as-a-Service (CPaaS) to deliver dynamically obfuscated malware via fake CAPTCHA social engineering and stealthy clipboard injection.
The ChocoPoC threat actor is targeting security researchers with trojanized GitHub PoC repositories that install malicious PyPI packages to deliver a Python-based RAT.
The Russia-aligned Gamaredon group significantly updated its arsenal in 2025, deploying six new PowerShell tools and leveraging legitimate cloud services and tunnels to target Ukrainian military and government institutions.
Threat actors are exploiting CVE-2026-48558 in SimpleHelp RMM software to deploy TaskWeaver and Djinn Stealer, targeting cloud, AI, and developer credentials across Windows, macOS, and Linux.
