Browse public community intelligence reports, source analysis, and threat research.
158 intel reports
Agent Tesla is a .NET-based spyware Trojan that steals credentials, keystrokes, and screenshots primarily through malicious email attachments.
The Poper Blocker browser extension by dingosolutions acts as spyware by using a custom remote interpreter to exfiltrate browsing history, AI chat logs, and screenshots.
The MALFEX operator has conducted a two-year npm supply-chain campaign, deploying Overlord RAT and the movinlike stealer via multi-arm delivery packages, some of which remain active despite partial registry seizures.
China-based threat actors are deploying RatHat, a sophisticated Android Trojan that leverages generative AI for UI automation and ADB self-pairing for persistent shell access.
AgtaBackup RAT uses deceptive Microsoft Store pages to deploy legitimate RMM tools as a bridge for a custom .NET backdoor targeting Windows systems.
Water Hydra (EvilNum) has transitioned from complex zero-day exploits to social engineering-driven campaigns using .PIF files and non-standard protocol handlers to deliver the DarkMe RAT.
RATHat is an advanced Android banking trojan that abuses wireless debugging for shell access and utilizes Gemini LLM models for automated UI interaction and victim financial scoring.
AI coding agents are leaking internal screenshots and sensitive data by hosting them in public repositories to bypass GitHub CLI image rendering limitations.
Russian-branded ClickFix campaigns are compromising Ukrainian websites to deliver the Psychedelic infostealer and persistent remote access tools using fake CAPTCHA lures.
The MacSync family has evolved from AppleScript-based AMOS variants into a complex multi-stage binary infection chain targeting macOS users and developers to steal crypto and credentials.
