Browse public community intelligence reports, source analysis, and threat research.
47 intel reports
FAMOUS CHOLLIMA (DPRK) distributes the MicrosoftSystem64 RAT via malicious npm packages, leveraging HuggingFace for binary updates and data exfiltration.
The threat actor JINX-0164 targets cryptocurrency industry developers using sophisticated macOS-specific malware, CI/CD compromise, and social engineering to steal digital assets and credentials.
MiniRAT is a Go-based macOS remote access trojan delivered via the compromised velora-dex-sdk npm package, utilizing LaunchAgent persistence and AES-encrypted C2 configurations.
North Korean state actor Sapphire Sleet targets cryptocurrency and finance sectors using social engineering and multi-stage AppleScript-based infection chains on macOS.
Threat actor 0xFFF (aka alh1mik) has released notnullOSX, a modular Go-based macOS stealer and backdoor targeting high-value cryptocurrency users through ClickFix social engineering.
Lazarus Group utilizes a macOS 1st-stage loader named unioncryptoupdater to execute 2nd-stage payloads directly from memory using repurposed open-source code.
Atomic Stealer (AMOS) leverages a new macOS persistence mechanism, anti-VM evasion, and trojanized hardware wallet applications to exfiltrate sensitive data and crypto credentials.
