Browse public community intelligence reports, source analysis, and threat research.
47 intel reports
Threat actors suspected to be SleepyDuck compromised Ethersphere's software supply chain to distribute backdoors and steal Ethereum wallet keys via npm and GitHub releases.
A trojanized version of the Claude Code for VS Code extension (2.1.312 and 2.1.313) on the Cursor Marketplace drops persistent SSH backdoors and exfiltrates host reconnaissance data across macOS, Linux, and Windows.
A trojanized version (2.1.313) of the Anthropic Claude Code VS Code extension plants a persistent SSH reverse tunnel and performs host reconnaissance.
Phexia is a modular macOS backdoor and infostealer delivered via ClickFix social engineering that utilizes Polygon smart contracts as dead-drop resolvers for C2 infrastructure.
The Shai-Hulud worm compromised the tensorlake npm package to steal developer credentials, AI tool configurations, and implement a self-destruct mechanism triggered by token revocation.
An unidentified attacker distributed a trojanized copy of the anthropic.claude-code editor extension that installs a persistent SSH reverse tunnel and backdoor. The analyzed sample targets macOS on Apple Silicon and the loader also contains Windows and Linux branches.
The GlassWorm threat actor distributed a trojanized version of the Claude Code extension via the Cursor Marketplace to plant a persistent SSH backdoor.
The SleepyDuck operation leverages fake Solidity VS Code extensions and steganographic MP4 files to deliver evjawbreaker implants and ScreenConnect backdoors.
The GlowComa threat actor is distributing ICMacOS, a macOS-targeted Malware-as-a-Service that has evolved from an information stealer into a persistent Remote Access Trojan (RAT).
The Phexia threat actor uses fake CAPTCHA 'ClickFix' lures to deploy a macOS backdoor that resolves its C2 hostname via a Polygon smart contract and drops multiple infostealers.
