Browse public community intelligence reports, source analysis, and threat research.
102 intel reports
The MexicanMafia threat actor, also known as PanchoVilla, is conducting a sophisticated campaign using the Kimera reconnaissance engine and custom exploits against perimeter devices in Latin America.
KongTuke and PS1Bot campaigns leverage malicious browser extensions and malvertising to deliver modular RATs and information stealers targeting Windows and macOS systems.
The Colombian Smugglers group and other actors utilize techniques like Device Code Phishing and SVG smuggling to deliver malware including rmrlx, vjw0rm, and UnixStealer.
Threat actor EvilTokens uses device code flow phishing to bypass MFA and obtain Primary Refresh Tokens for persistent Microsoft 365 access.
The EvilTokens Phishing-as-a-Service leverages Microsoft device code authentication flows and AI-driven automation to exfiltrate tokens and orchestrate large-scale Business Email Compromise (BEC) attacks.
A multi-stage HTA-based loader uses VBScript and PowerShell to deploy the Lightlife RAT, targeting crypto wallets and establishing persistence via Russian infrastructure.
UNC5342 utilizes the EtherHiding technique on the BNB Smart Chain testnet to host immutable ClearFake payload routing instructions targeting Windows and macOS users.
The Kali365 Live PhaaS platform enables large-scale device code phishing and AitM session capture targeting Microsoft 365 environments across multiple sectors.
Threat actors including GOLD ENCOUNTER and campaigns STAC4713/STAC3725 are abusing QEMU virtualization to hide backdoors and deploy PayoutsKing and 3AM ransomware.
Canis C2 is a previously undocumented cross-platform surveillance framework targeting Japanese users with sophisticated mobile agents and OS-specific fingerprinting.
