Browse public community intelligence reports, source analysis, and threat research.
88 intel reports
Russia-aligned threat actor UAC-0099 is using the GuardBreaker technique to trip AI safety guardrails and blind automated malware analysis tools targeting Ukrainian critical infrastructure.
A maintainer compromise on the pub.dev platform led to the injection of malicious build-time scripts targeting developer credentials in the Flutter ecosystem.
An unidentified actor compromised Coder's Cloudflare-managed registry infrastructure to distribute malicious Terraform modules that steal infrastructure credentials and API keys.
The Superior threat actor uses 19 malicious Chrome and Edge extensions to deliver wallet drainers and credential-stealing payloads through a modular JavaScript framework.
ChainDrop, a descendant of the Shai-Hulud malware family, is a self-propagating npm worm targeting developer workstations and CI/CD pipelines to harvest cloud, registry, and AI tool credentials.
Researchers identified a stored XSS vulnerability in Open VSX that allows attackers to hijack extension maintainer accounts and distribute malicious updates to millions of developers.
An unidentified operator deployed 28 malicious 'evil-twin' Open VSX extensions that exfiltrate developer environment data to i.apee.my.id using multiple network evasion techniques.
Twill Typhoon leverages a supply chain compromise of the QuickFox VPN proxy to deliver the FDMTP implant through multi-stage loaders and execution guardrails.
UNC6780 and MIDNIGHT NEPTUNE target open-source repositories and AI coding environments to deploy credential stealers and backdoors via malicious package dependencies.
The WhiteCobra threat actor is deploying malicious 'Solidity Pro' VS Code extensions that evolve from Cloudflare-hosted Python droppers to comprehensive credential and wallet infostealers.
