Browse public community intelligence reports, source analysis, and threat research.
13 intel reports
Adversaries compromised the LiteLLM supply chain to distribute a credential stealer and remote code loader targeting cloud, AI, and developer secrets.
China-based threat actors are deploying RatHat, a sophisticated Android Trojan that leverages generative AI for UI automation and ADB self-pairing for persistent shell access.
Adversaries such as TeamPCP exploit Python package installation mechanisms including setup.py hooks, .pth files, and entry points to compromise developer environments and CI/CD pipelines.
The SC WordPress malware utilizes a redundant eight-component mesh across files, databases, and shared memory to self-heal and communicate via Ethereum blockchain gateways.
The UNK_CondorFiltration campaign utilizes the TeamFiltration framework to compromise unmanaged Microsoft 365 service accounts in Chile through password spraying.
Unknown actors compromised MemTensor packages on npm and PyPI to deliver 'sckit', a Go-based worm designed for credential harvesting and self-propagation via CI/CD pipelines.
Russian-linked DOUBLECUP Loader-as-a-Service facilitates ClickFix campaigns delivering CountLoader and a new blockchain-resolving RAT named DeviceManager.
An unprivileged user can exploit a logic flaw in the Windows Installer service to delete arbitrary folders as SYSTEM and subsequently execute code by planting malicious rollback scripts.
The Miasma worm campaign compromised 20 LeoPlatform npm packages and a Verana Blockchain Go module to deploy a Bun-based credential stealer targeting developer environments and CI/CD pipelines.
The MexicanMafia threat actor, also known as PanchoVilla, is conducting a sophisticated campaign using the Kimera reconnaissance engine and custom exploits against perimeter devices in Latin America.
