Browse public community intelligence reports, source analysis, and threat research.
76 intel reports
PolinRider threat actors hijacked two Joyfill npm packages to distribute an obfuscated five-stage malware chain using blockchain-based C2 resolution and a Python credential stealer.
A sophisticated multi-stage campaign uses HijackLoader to deploy Vidar infostealers and the SnappyClient RAT via DLL side-loading and process hollowing.
Attackers compromised Adform's advertising tracking script trackpoint-async.js to replace cryptocurrency wallet addresses in user clipboards and web forms.
Evidence refutes the attribution of TAG-150 commodity Russian Malware-as-a-Service (MaaS) and ClixFlare infrastructure to the Iranian state actor MuddyWater.
The TAG-195 threat group is using the ChonkyChicken RAT and ChromEggscalator helper to bypass Chrome App-Bound encryption and hijack authenticated browser sessions via the ClickFix social engineering technique.
Suspected Chinese-speaking threat actors target Central Asian government sectors using two new obfuscated backdoors, OctLurk and SilkLurk, for data theft and persistent access.
BlueNoroff is utilizing an advanced phishing kit to impersonate Zoom and Microsoft Teams, profiling cryptocurrency wallets before delivering tailored malware to high-value targets.
TAG-195 (Golden Chickens) has introduced a new generation of modular malware, including TinyEgg and ChonkyChicken, featuring enhanced browser credential theft and session automation via CDP.
Stealth Falcon utilized an LLM-accelerated WebDAV delivery lab to deploy PureRAT via working directory hijacking and DLL sideloading targeting Mexican enterprise users.
DPRK-aligned threat actors are targeting developers with fake coding interviews that deliver OTTERCOOKIE malware via SVG-based steganography.
