Browse public community intelligence reports, source analysis, and threat research.
21 intel reports
VAPOR PANDA is using the ARTEX agentic AI framework and DeepSeek LLM to conduct simultaneous global espionage against foreign ministries and critical infrastructure sectors.
Adversaries compromised the LiteLLM supply chain to distribute a credential stealer and remote code loader targeting cloud, AI, and developer secrets.
The Shai-Hulud worm compromised the tensorlake npm package to steal developer credentials, AI tool configurations, and implement a self-destruct mechanism triggered by token revocation.
The Shai-Hulud worm compromised the tensorlake npm package to exfiltrate secrets and cryptocurrency browser data while implementing a destructive 'dead-man's switch' upon token revocation.
Agentic AI Secret Hunter exploits Langflow and PHP vulnerabilities to steal AI-provider credentials and Azure service principal tokens for cloud resource abuse.
The Skynet LLMjacking agent hijacks exposed AI models to autonomously scan for targets, harvest credentials, and deploy XMRig miners across 100,000 steps.
The Gheist campaign utilizes stolen GitHub tokens to plant malicious workflows that exfiltrate secrets via base32-encoded logs, circumventing traditional security masks.
Threat actor TeamPCP executed a massive supply chain campaign compromising GitHub Actions from Aqua Security and Checkmarx, VS Code extensions, and npm packages to deploy a multi-stage credential stealer and a self-propagating worm.
An unidentified threat actor published malicious npm packages posing as Twilio security research tools to exfiltrate sensitive API credentials and system metadata.
Grafana MCP servers were found vulnerable to a critical killchain involving session spoofing and a 9.1 CVSS SSRF vulnerability that allows unauthenticated access to internal infrastructure.
