Browse public community intelligence reports, source analysis, and threat research.
94 intel reports
The Shai-Hulud worm compromised the tensorlake npm package to exfiltrate secrets and cryptocurrency browser data while implementing a destructive 'dead-man's switch' upon token revocation.
An operator exfiltrated over 68 GB of SQL Server backups from a Philippine government agency and staged a rebranded GodPotato tool named Wrqsnx on an open directory.
The ROMULUS delivery platform utilizes ClickFix lures and social engineering to distribute diverse payloads including LegionLoader, Atlas RAT, and RomulusLoader targeting global organizations.
Threat actors compromised LiteLLM's CI/CD pipeline by exploiting leaked GitHub CLI tokens in logs to distribute a malicious Python package containing the privcollect stealer and a RAT.
A ClickFix campaign utilizes EtherHiding via BSC testnet contracts to deliver multi-stage PowerShell loaders that inject shellcode into MicrosoftEdgeUpdate.exe.
The bonto.io campaign uses malicious Firefox extensions impersonating Phantom, Jupiter, and Bitget wallets to steal recovery phrases and private keys.
KGB RAT is a Windows-based Malware-as-a-Service (MaaS) tool providing Remote Access Trojan capabilities, including credential theft, HVNC, ransomware, and cryptocurrency wallet swapping.
Glassworm threat actors compromised a contributor's GitHub account to replace official OVHcloud CLI release binaries with secret-stealing malware using a Solana-based dead drop for command and control.
A malicious loader disguised as a Capacitor configuration file executes remote JavaScript by decoding an environment variable and masking failures as authentication errors.
The Ebury botnet hijacked over 300 Tor exit relays to perform Man-in-the-Middle (MitM) attacks on SSH traffic, capturing login credentials and installing further malware.
