Browse public community intelligence reports, source analysis, and threat research.
76 intel reports
The Ousaban banking trojan utilizes geofenced phishing pages and steganography to target users in Spain and Portugal with remote access and credential theft capabilities.
Adversaries are leveraging the ClickFix social engineering technique to deploy the AMOS infostealer on macOS and malicious PowerShell payloads on Windows via clipboard hijacking.
The Drun Backdoor is a modular two-stage infostealer that utilizes the Chromelevator loader to inject into processes via direct syscalls, targeting browser credentials, session tokens, and gaming accounts.
The Phantom Stealer campaign targets banks and high-value organizations using fileless techniques and a layered dropper to exfiltrate browser credentials and financial data.
North Korea-aligned actors are targeting developers via phishing and malicious GitHub repositories using VS Code's 'runOn' features to deliver cross-platform malware.
KongTuke and PS1Bot campaigns leverage malicious browser extensions and malvertising to deliver modular RATs and information stealers targeting Windows and macOS systems.
The SStar Agent is a Go-based cross-platform RAT delivered via a poisoned npm package (tw-style-utils) targeting Web3 developers with surveillance and exfiltration capabilities.
RemusStealer and the SessionGate framework are distributed through a complex ecosystem of impersonation websites and gated Traffic Distribution Systems (TDS) targeting technical users.
The threat actor JINX-0164 targets cryptocurrency industry developers using sophisticated macOS-specific malware, CI/CD compromise, and social engineering to steal digital assets and credentials.
SilverFox APT is targeting users with fake Microsoft Teams download sites to deliver ValleyRAT through a multi-stage DLL sideloading chain and in-memory execution.
