Browse public community intelligence reports, source analysis, and threat research.
106 intel reports
TELEPUZ is a full-featured modular malware spreading through CLICKFIX social engineering and VIDAR stealer, featuring advanced evasion and dead-drop resolver techniques.
DPRK-aligned threat actors are targeting developers with fake coding interviews that deliver OTTERCOOKIE malware via SVG-based steganography.
A sophisticated supply chain attack compromised the AsyncAPI npm organization to distribute the Miasma multi-stage dropper, targeting developers for credential theft and lateral movement.
NadMesh is an autonomous, Go-based botnet designed to harvest AI service credentials and exploit infrastructure including Docker, Kubernetes, and Model Context Protocol (MCP) services.
Threat actors are increasingly using LLMs to generate bespoke, functional malware and automate complex Active Directory enumeration, data exfiltration, and extortion workflows.
ClickLock Dev uses ClickFix social engineering and aggressive process-killing loops to steal credentials and crypto wallets from macOS users in Europe and North America.
The Kratos Phishing-as-a-Service (PhaaS) platform targets Microsoft 365 credentials in the US and Europe using sophisticated multi-generation phishing kits and anti-bot measures.
Salat Stealer, a Go-based information stealer, is distributed via gaming utilities like Xeno Executor to harvest credentials, crypto wallets, and perform live surveillance.
The MemGhost framework automates stealth memory injection into persistent AI agents like OpenClaw, enabling long-term compromise via a single adversarial email.
Educational writeup documenting various SQL Injection (SQLi) techniques, including UNION-based, blind, error-based, and out-of-band exfiltration targeting common SGBDs.
