Browse public community intelligence reports, source analysis, and threat research.
102 intel reports
Storm-2992 operates EvilTokens, an AI-driven Phishing-as-a-Service platform targeting Microsoft 365 through device code authentication abuse to facilitate business email compromise.
The Corp MDM Android spyware campaign targets logistics companies using fake Google Play pages to exfiltrate SMS data and divert calls to facilitate cargo theft.
Iranian state cyber actors are using CHOSEN BRICK, a Windows-based spyware, to monitor dissidents and activists through social engineering and Telegram-based command and control.
Konni, a DPRK-nexus actor, is targeting Ukrainian entities using socio-economic lures to deploy VelvetCake, a modular PowerShell-based task runner and reconnaissance tool.
The North Korean WaterPlum group uses fake job interviews and malicious development tools to compromise IT professionals, stealing over $10.7 million in cryptocurrency.
The SideCopy APT is targeting Indian academic institutions using weaponized LNK files and mshta.exe to deploy ReverseRAT via fileless .NET deserialization.
The N0va phishkit targets US and EU organizations across multiple sectors using device code authentication flows to capture access tokens and establish persistent SSO access.
An adversary uses malicious Google Apps Scripts in Google Doc sidebars to deliver AMOS and NetSupport Manager malware targeting both macOS and Windows users.
Oldphantomoftheopera and Phantom Softwares operate Phantom Stealer, a Malware-as-a-Service infostealer targeting Windows systems through multi-stage in-memory execution and obfuscated PowerShell to harvest credentials and cryptocurrency data.
An unattributed threat actor launched a mass ACH fraud campaign using AI-assisted templates to impersonate executives and vendors, targeting accounts payable departments with highly personalized lures.
