Browse public community intelligence reports, source analysis, and threat research.
123 intel reports
MadApe is an undocumented phishing kit that abuses Microsoft Device Code authentication via business-themed PDF lures and multi-stage redirects to compromise Microsoft 365 accounts.
APT28 (Swallowtail) is executing a complex cyber espionage campaign targeting NATO naval and aerospace manufacturers using the Hookedge backdoor and a novel reflective loader.
An extensive phishing campaign impersonating the U.S. District Court targets over 100,000 companies using personalized lures to deliver the LodaRAT remote access trojan via malicious ISO files.
Attackers are abusing Microsoft Power BI dashboards to host malicious links that deliver redundant ScreenConnect RMM installers for persistent remote access.
SkyW4lker is a device-code phishing kit targeting Microsoft 365 users, primarily in the US technology and manufacturing sectors, to bypass MFA and obtain access tokens.
The Lazarus Group is targeting South Korean sectors by exploiting mandatory financial security software to deploy a sophisticated malware framework featuring post-quantum encryption.
Storm-3119 (YAM Store) acts as a power broker selling compromised Microsoft 365 and Google infrastructure to Storm-2990, who develops and operates global Phishing-as-a-Service (PaaS) kits.
Unknown threat actors compromised ConnectWise Cloud Backup application identities to gain unauthorized access to Microsoft 365 tenants across multiple sectors.
The threat actor UNG0002 is targeting academic institutions using macOS-style metadata folder structures to evade Windows security scanners and deliver Cobalt Strike via DLL sideloading.
Threat actors are abusing legitimate Microsoft Power BI domains to host phishing lures that deliver multiple rogue ScreenConnect instances for persistent remote access.
