Browse public community intelligence reports, source analysis, and threat research.
47 intel reports
The North Korean threat actor Jade Sleet (TraderTraitor) is targeting DevOps engineers at IT services firms using weaponized Terraform coding projects and macOS backdoors FLATROOF and ROOFDECK.
PamStealer targets macOS users via fake 'Wavel' crypto wallet lures, utilizing a novel live server-side decryption utility (pkgunpack) and a Swift-based infostealer payload.
ParaShells (CVE-2026-90894) allows a local non-admin macOS user to gain root access by exploiting a world-writable socket and argument injection in the Parallels Desktop background service.
CRPx0 is a sophisticated cross-platform ransomware-as-a-service operation using ClickFix social engineering lures to deliver multi-stage Python-based payloads via clipboard hijacking.
Lazarus Group is targeting macOS users with trojanized application installers that deliver the OtterCookie RAT through a multi-stage infection chain.
Mini Shai-Hulud threat actors compromised the '@7nohe/openapi-react-query-codegen' npm package by abusing comment-triggered GitHub Actions workflows to publish malicious versions targeting cloud and registry credentials.
DPRK-nexus actors, likely Sapphire Sleet, leveraged malicious Rust packages on crates.io to deploy Rustbot, a macOS RAT targeting cloud credentials and cryptocurrency wallets.
Mirage Kitten targets aviation and FinTech sectors in the Middle East and Africa using cross-platform Node.js and JavaScript RATs delivered via trojanized coding challenges.
ChainDrop, a descendant of the Shai-Hulud malware family, is a self-propagating npm worm targeting developer workstations and CI/CD pipelines to harvest cloud, registry, and AI tool credentials.
Attackers are exploiting CVE-2026-65400, a critical macOS Screen Sharing authentication bypass, to gain root access and deploy Monero miners on internet-exposed systems.
