Browse public community intelligence reports, source analysis, and threat research.
17 intel reports
Armorsteal is a Python-based malware kit delivered via SEO poisoning that exfiltrates browser credentials, Discord tokens, and crypto wallets while deploying hidden XMRig miners.
Phexia is a modular macOS backdoor and infostealer delivered via ClickFix social engineering that utilizes Polygon smart contracts as dead-drop resolvers for C2 infrastructure.
Russian-speaking actors NyashTeam and Kapchenka operate Salat Stealer (WEB_RAT), a Go-based MaaS targeting Windows for credential and cryptocurrency theft.
The GlowComa threat actor is distributing ICMacOS, a macOS-targeted Malware-as-a-Service that has evolved from an information stealer into a persistent Remote Access Trojan (RAT).
Atomic macOS (AMOS) Stealer targets macOS users through social engineering campaigns masquerading as software toolkits, exfiltrating browser data, credentials, and cryptocurrency wallets.
An unidentified actor compromised Coder's Cloudflare-managed registry infrastructure to distribute malicious Terraform modules that steal infrastructure credentials and API keys.
ChainDrop, a descendant of the Shai-Hulud malware family, is a self-propagating npm worm targeting developer workstations and CI/CD pipelines to harvest cloud, registry, and AI tool credentials.
Atomic MacOS (AMOS) stealer targets Apple users through malicious websites that trick users into pasting terminal commands which download and execute credential-harvesting scripts.
A Chinese-speaking threat actor (Asia-Pacific Group) is utilizing leaked DarkSword exploit kit source code to target iOS 18.4-18.7 devices using GHOSTBLADE malware.
ClickLock Dev uses ClickFix social engineering and aggressive process-killing loops to steal credentials and crypto wallets from macOS users in Europe and North America.
