Intel Exchange

Kynx is a C++ infostealer developed with AI assistance that targets browser credentials, crypto wallets, gaming platforms, and AI coding assistants like Claude and Cursor.

Gunra is a Conti-derived ransomware-as-a-service (RaaS) targeting global critical infrastructure using double-extortion and cross-platform encryptors.

Gunra (also known as Golden Community) is a RaaS operation using a double-extortion model targeting critical infrastructure by exploiting vulnerabilities in Fortinet appliances and leveraging Impacket for lateral movement.

The threat actor Storm-2755, also known as Payroll Pirates, uses adversary-in-the-middle (AiTM) phishing and residential proxies to compromise Microsoft 365 accounts for targeted financial data collection.

Russian state-supported actors including LAUNDRY BEAR and TA458 are exploiting zero-day vulnerabilities in Zimbra, SOGo, and other webmail clients to exfiltrate sensitive email data from Western government and commercial targets.

Suspected Chinese-speaking threat actors target Central Asian government sectors using two new obfuscated backdoors, OctLurk and SilkLurk, for data theft and persistent access.

Attackers are abusing the OAuth 2.0 device authorization grant to trick users into authenticating malicious sessions on legitimate Microsoft sign-in pages, bypassing MFA.

Russian-affiliated threat actor CL-STA-1114 exploits a zero-click vulnerability in Zimbra Collaboration Suite to exfiltrate user credentials and email archives from global targets.

Egyptian threat actor codemado and associates leverage custom Evilginx forks and Device Code Flow abuse to target Microsoft 365 and cryptocurrency users.

The Forg365 Phishing-as-a-Service platform utilizes AI-assisted lures, device-code flow abuse, and a custom browser extension to compromise and maintain access to Microsoft 365 environments.