Browse public community intelligence reports, source analysis, and threat research.
107 intel reports
Educational writeup documenting various SQL Injection (SQLi) techniques, including UNION-based, blind, error-based, and out-of-band exfiltration targeting common SGBDs.
A threat actor compromised the jscrambler npm package, delivering cross-platform Rust-based infostealers through malicious preinstall hooks and self-executing functions targeting developers and CI/CD environments.
CrashStealer is a native C++ macOS information stealer that impersonates Apple crash-reporting tools and uses notarized droppers to harvest credentials, keychain data, and crypto wallets.
Russian-speaking threat actors are exploiting CVE-2026-35616 in FortiClient EMS to deploy EKZ Stealer and FortigateSniffer, facilitating credential harvesting and subsequent ransomware attacks by INC Ransom and Lynx.
Cavern Manticore, an Iran-nexus APT group, utilizes a modular .NET C2 framework targeting Israeli government and IT sectors through RMM abuse and DLL sideloading.
Akira ransomware actors utilized Bumblebee malware and AdaptixC2 via Bing SEO poisoning to gain initial access, move laterally, and exfiltrate over 75GB of data.
TeamPCP and related campaigns are targeting GitHub Actions CI runners using malware like Megalodon and Miasma to harvest credentials and persist within development pipelines.
The StegoAd campaign utilized 119 malicious browser extensions to perform ad fraud and steal Google and WordPress credentials from 2.6 million users.
Lazarus-linked North Korean actors are targeting software developers via hijacked npm/Go packages and fraudulent job interviews to deploy the InvisibleFerret infostealer.
Threat actors are exploiting CVE-2026-48558 in SimpleHelp RMM software to deploy TaskWeaver and Djinn Stealer, targeting cloud, AI, and developer credentials across Windows, macOS, and Linux.
