Browse public community intelligence reports, source analysis, and threat research.
174 intel reports
Suspected Silver Fox actors are targeting Latin American banking and financial sectors using fake DocuSign and NFe tax lures to deliver a custom HVNC backdoor for persistent remote control.
LiteLLM vulnerabilities (CVE-2026-59821, CVE-2026-59822) enable unauthenticated attackers to bypass security controls, achieve root-level RCE, and exfiltrate cloud IAM credentials.
Russian-linked threat actor UAT-10820 utilizes ClearFake infection chains and WebDAV-hosted DLLs to deploy Amatera stealer and follow-on payloads like ZigCryptoStealer and NetSupport Manager.
DPRK-linked actors (Kimsuky, APT37, Lazarus) are using the Ted backdoor and CurlRAT framework to target South Korean media and automotive sectors for long-term espionage and watering-hole attacks.
The WEEVILPROXY threat actor is deploying JSCeal, a compiled V8 JavaScript malware that uses stolen session cookies to bypass Google authentication and target cryptocurrency investors.
Cybercriminals are using multiple infostealer families and malicious Claude Artifacts to bypass 2FA by stealing session cookies and hijacking AI agent configurations.
Threat actors are leveraging compromised WordPress sites and blockchain smart contracts to deliver Amatera password stealers and WebRTC stagers through ClickFix lures.
The Exilware threat group uses the AI-driven BraZetsu Python framework to compromise Windows hosts and monetize access via the 'Infect Marketplace.'
A Russian-speaking Aurora ransomware affiliate utilizes AI-assisted planning and Active Directory exploits to compromise over twenty organizations globally before deploying a Zig-based encryptor.
The Armadin Attacker uses a new tool called PRTremote to hijack Entra ID Primary Refresh Tokens by executing scheduled tasks within interactive user sessions over SMB.
