Browse public community intelligence reports, source analysis, and threat research.
26 intel reports
The Skynet LLMjacking agent hijacks exposed AI models to autonomously scan for targets, harvest credentials, and deploy XMRig miners across 100,000 steps.
The Gheist campaign utilizes stolen GitHub tokens to plant malicious workflows that exfiltrate secrets via base32-encoded logs, circumventing traditional security masks.
The Yoba campaign utilizes SEO-poisoned GitHub repositories and fake AI desktop applications to distribute a custom loader that delivers XMRig miners via DLL sideloading.
The Yoba campaign delivers YobaLoader and XMRig by abusing fake ChatGPT and Claude desktop apps through DLL sideloading and DNS-over-HTTPS C2 techniques.
Threat actors are exploiting a remote code execution vulnerability in REDCap servers (CVE-2026-90817) to deploy XMRig miners using fileless techniques and steganography.
The PoeLLM malware campaign targets exposed AI/LLM services like LiteLLM and Ollama for cryptomining and lateral scanning using a novel GitHub-based steganographic C2 mechanism.
An operator identified as Zaib Ali uses a massive npm typosquatting campaign to discover infrastructure and a custom FastAPI framework called VHX Harvester to hijack GPU resources on the vast.ai marketplace.
Threat actors are targeting internet-exposed MSSQL servers via SA account brute forcing to deploy XMRig miners using xp_cmdshell and multi-layered persistence.
The CARBONATO botnet exploits unauthenticated Docker daemons to deploy an AI-driven Hermes Agent for automated post-exploitation and credential harvesting via Telegram.
Unauthenticated attackers are exploiting CVE-2026-73570 in Zimbra Collaboration Suite to deploy JSP webshells, escalate privileges via PAM, and exfiltrate mailbox data.
