Browse public community intelligence reports, source analysis, and threat research.
32 intel reports
A threat actor compromised a Mastra maintainer account to poison 140+ npm packages with a malicious dependency used for cross-platform backdoors and credential exfiltration.
Researchers discovered a critical zero-click vulnerability in Opera GX's mod installation pipeline that allows malicious sites to perform universal CSS injection and steal sensitive data via XS-Leaks.
Rapid Brigantine and other cybercrime clusters are utilizing ClickFix social engineering to deploy modular loaders and backdoors including Potemkin, RMMProject, BabaDeda, and Lorem Ipsum.
The VEIL#DROP framework utilizes Google's Blogspot platform and living-off-the-land binaries to deploy the PureLog Stealer in memory via a multi-stage fileless chain.
Rapid Brigantine has pivoted to ClickFix lures on compromised WordPress sites to deploy the Lorem Ipsum Loader following a disruption to their previous malware-signing infrastructure.
The ErrTraffic Malware-as-a-Service framework uses the ClickFix social engineering tactic and EtherHiding blockchain dead-drop resolvers to distribute infostealers and loaders through compromised WordPress sites and fake AI platforms.
The AutoJack exploit chain leverages a confused deputy browsing agent to bypass localhost trust boundaries and achieve RCE in Microsoft's AutoGen Studio.
KongTuke and PS1Bot campaigns leverage malicious browser extensions and malvertising to deliver modular RATs and information stealers targeting Windows and macOS systems.
Threat actor link99 systematically exploits abandoned Azure and DigitalOcean DNS zone delegations to host Thai gambling platforms under the authority of over 160 enterprise and government domains.
An attacker can steal broadly-scoped GitHub OAuth tokens by exploiting VSCode webview message handling to simulate keystrokes and install malicious extensions.
