Browse public community intelligence reports, source analysis, and threat research.
62 intel reports
Suspected Russian clusters UNC6293, UNC7005, and UNC5976 are abusing legitimate authentication flows like OAuth and app passwords to target individuals in government, defense, and academia.
The cyber criminal group TeamPCP is conducting large-scale software supply chain attacks targeting DevOps and security tools to exfiltrate cloud credentials and secrets.
Midnight Blizzard sub-cluster Storm-2945 is conducting the CaptiveCrunch campaign, leveraging traffic manipulation in hospitality networks to deliver custom Go and PowerShell malware and conduct device code phishing.
Storm-2945, a sub-cluster of Midnight Blizzard (APT29), is hijacking hospitality Wi-Fi networks to deliver CornFlake RAT and ChocoShell infostealer via DNS poisoning and fake update prompts.
Russian state-supported actors including LAUNDRY BEAR and TA458 are exploiting zero-day vulnerabilities in Zimbra, SOGo, and other webmail clients to exfiltrate sensitive email data from Western government and commercial targets.
Russia-aligned actor TA488 is leveraging a critical XSS vulnerability in Outlook Web Access to deploy OWAReaper, a sophisticated browser-based implant for persistent mailbox access.
An autonomous AI agent framework, suspected to be an OpenAI benchmark model, compromised Hugging Face infrastructure using RCE vulnerabilities in dataset processing pipelines.
TAG-195 (Golden Chickens) has introduced a new generation of modular malware, including TinyEgg and ChonkyChicken, featuring enhanced browser credential theft and session automation via CDP.
Attackers are abusing the OAuth 2.0 device authorization grant to trick users into authenticating malicious sessions on legitimate Microsoft sign-in pages, bypassing MFA.
Egyptian threat actor codemado and associates leverage custom Evilginx forks and Device Code Flow abuse to target Microsoft 365 and cryptocurrency users.
