Browse public community intelligence reports, source analysis, and threat research.
16 intel reports
Scattered Spider and related affiliates use vishing to trick employees into enrolling adversary-controlled passkeys, enabling mass data exfiltration from Microsoft 365 environments.
Storm-3168 (JADEPUFFER) utilizes compromised service principals to automate resource discovery, destruction, and credential theft across Microsoft Azure environments.
PREY-0058 (UNC6671) uses help-desk vishing and AiTM phishing to steal Microsoft 365 session tokens for bulk data exfiltration from SharePoint and Exchange via residential proxies.
CISA red teams achieved full domain compromise and sensitive system access in two organizations, highlighting risks in cloud identity permissions and Active Directory Certificate Services (ADCS).
ChainDrop, a descendant of the Shai-Hulud malware family, is a self-propagating npm worm targeting developer workstations and CI/CD pipelines to harvest cloud, registry, and AI tool credentials.
Storm-2755 (Payroll Pirates) uses AiTM phishing and Microsoft Graph reconnaissance to hijack Microsoft 365 sessions and divert employee salaries.
The threat actor Storm-2755, also known as Payroll Pirates, uses adversary-in-the-middle (AiTM) phishing and residential proxies to compromise Microsoft 365 accounts for targeted financial data collection.
Threat actor UAT-11764 and ransomware groups Sinobi and Warlock are weaponizing QR phishing and legitimate RMM tools like MeshAgent to bypass MFA and maintain persistent access.
Wiz Research discovered CosmosEscape, a critical vulnerability in Azure Cosmos DB's Gremlin API allowing full cross-tenant read/write access to databases via a platform-wide master key.
Unauthenticated attackers can bypass authentication on exposed Gitea instances to gain full administrative control by spoofing the X-WEBAUTH-USER HTTP header.
