Browse public community intelligence reports, source analysis, and threat research.
130 intel reports
The Miasma worm campaign compromised 20 LeoPlatform npm packages and a Verana Blockchain Go module to deploy a Bun-based credential stealer targeting developer environments and CI/CD pipelines.
Adversaries are leveraging the ClickFix social engineering technique to deploy the AMOS infostealer on macOS and malicious PowerShell payloads on Windows via clipboard hijacking.
SilverFox actors are utilizing a multi-stage loader chain masquerading as Panasonic and Philips software to deploy Sauron/Gh0stRAT backdoors via Alibaba OSS infrastructure.
Researchers from AIR created a fake AI agent skill named brand-landingpage that bypassed multiple security scanners to reach 26,000 agents by hosting malicious instructions on an external domain.
An unidentified threat actor is targeting Thailand's healthcare sector using healthcare-themed lures to deploy a Python-based information stealer via multi-stage batch scripts.
A new macOS ClickFix campaign uses social engineering to trick users into running Terminal commands that silently mount DMGs and execute the Atomic macOS Stealer (AMOS).
KongTuke and PS1Bot campaigns leverage malicious browser extensions and malvertising to deliver modular RATs and information stealers targeting Windows and macOS systems.
The Pakistan-aligned APT36 is deploying a new variant of the SHEETCREEP RAT using Google Sheets for C2 communication, targeting Indian diplomatic interests.
A threat actor operating as Leda Elacoate is conducting a supply chain campaign using trojanized installers for crypto-trading and VPN software to deploy the STX RAT infostealer via DLL sideloading.
The UNK_DeadDrop threat actor targets developers with fake recruitment and code review phishing campaigns to deploy cross-platform malware for cryptocurrency theft.
