Browse public community intelligence reports, source analysis, and threat research.
4 intel reports
ClickFix campaigns are deploying PavinLoader, a multi-stage .NET loader that uses EtherHiding and MSBuild to deliver Amatera Stealer and other payloads.
ACRStealer campaign leverages a legitimate, Microsoft-signed Korean DLP driver (DCRCVDrv.sys) to perform kernel-context process termination for security software suppression.
Remcos RAT is a sophisticated Windows remote access trojan used by actors like APT33 and UAC-0050 for extensive surveillance, credential theft, and full system control.
The VEIL#DROP framework utilizes Google's Blogspot platform and living-off-the-land binaries to deploy the PureLog Stealer in memory via a multi-stage fileless chain.
