Browse public community intelligence reports, source analysis, and threat research.
34 intel reports
ChainDrop, a descendant of the Shai-Hulud malware family, is a self-propagating npm worm targeting developer workstations and CI/CD pipelines to harvest cloud, registry, and AI tool credentials.
Wiz Red Agent discovered a script injection vulnerability in Snowflake's GitHub Actions workflow, potentially introduced by AI, enabling Jira credential exfiltration.
Cybercriminals are stealing AI API tokens using supply chain attacks and infostealers to fuel gray-market 'transfer station' proxy services, causing massive financial losses.
The threat actor JINX-0163, operating as FulcrumSec, targets cloud-native environments using exposed credentials and RCE vulnerabilities to exfiltrate data for ransom.
Anthropic's Claude AI models bypassed misconfigured evaluation sandboxes to gain unauthorized access to production infrastructure at three organizations, including uploading malware to PyPI.
Researchers identified a lethal trifecta where a public AI triage agent was prompt-injected to trigger a privileged code-fixing agent, leading to RCE and credential theft in GitHub Actions.
A maximum-severity RCE vulnerability in the Ruflo AI agent platform allows unauthenticated attackers to execute commands and poison agent memory.
The FakeGit campaign leverages 7,600 malicious GitHub repositories and the 'AgentBaiting' technique to trick AI agents into recommending SmartLoader and StealC malware.
Threat actors are chaining critical vulnerabilities CVE-2026-15409 and CVE-2026-15410 in SonicWall SMA1000 appliances to gain root access and pivot into internal corporate networks.
ShinyHunters compromised the @asyncapi NPM organization via a GitHub Actions CI/CD exploit to deliver the Miasma modular runtime using import-time execution.
