Browse public community intelligence reports, source analysis, and threat research.
18 intel reports
Kimsuky (APT43) leverages fake job offers, conference invitations, and logistics decoys to deliver the OverLord infostealer to AI and blockchain developers via ClickFix techniques.
A Russian-speaking threat actor uses XaocMail phishing and ClickFix lures to deploy the Phantom53 DoH framework and Havoc post-exploitation agents.
Phexia is a modular macOS backdoor and infostealer delivered via ClickFix social engineering that utilizes Polygon smart contracts as dead-drop resolvers for C2 infrastructure.
The ROMULUS delivery platform utilizes ClickFix lures and social engineering to distribute diverse payloads including LegionLoader, Atlas RAT, and RomulusLoader targeting global organizations.
CrocoRat is a Python-based remote access trojan and cryptocurrency stealer delivered via ClickFix social engineering and novel DNS TXT record payload staging.
The GlowComa threat actor is distributing ICMacOS, a macOS-targeted Malware-as-a-Service that has evolved from an information stealer into a persistent Remote Access Trojan (RAT).
Atomic macOS Stealer (AMOS) is being delivered via a sophisticated ClickFix attack chain that uses a deceptive Xcode download site to trick users into executing malicious Terminal commands.
AvisLoader is a Windows loader using the Tox encrypted peer-to-peer messaging network for command-and-control to evade traditional domain-based takedowns.
Sapphire Sleet, a North Korean state actor, is targeting the cryptocurrency and IT sectors through sophisticated npm supply chain compromises and social engineering lures on professional platforms.
Adversaries are globally leveraging the ClickFix social engineering technique to trick Windows and macOS users into executing malicious terminal commands that deliver infostealers and RATs.
