Browse public community intelligence reports, source analysis, and threat research.
16 intel reports
Researchers identified a technique where attackers can redirect cloud data streams by deleting a target storage bucket and recreating it in an attacker-controlled account using the same globally unique name.
Threat actors are increasingly leveraging compromised Microsoft Intune administrative accounts to deploy malicious scripts and perform fleet-wide device wipes.
The CL-CRI-1089 threat actor is conducting malvertising campaigns targeting macOS users to deploy FlutterShell, a Flutter-based backdoor that facilitates browser hijacking and arbitrary command execution.
The threat actor Storm-2949 leverages social engineering and SSPR abuse to compromise identities, pivoting to Azure control-plane operations for massive data exfiltration.
TeamPCP executed a cascading supply chain campaign using the CanisterWorm and Cloud Stealer malware to harvest credentials from GitHub Actions and PyPI packages.
The EvilTokens Phishing-as-a-Service platform is weaponizing Railway.com PaaS infrastructure to conduct large-scale OAuth token replay and device code phishing campaigns against Microsoft 365 environments.
