Browse public community intelligence reports, source analysis, and threat research.
123 intel reports
The Veil#Drop framework utilizes a multi-stage infection chain involving JavaScript launchers and PowerShell cradles hosted on Blogspot to deploy PureLog Stealer in memory.
Threat actors are weaponizing the Microsoft Device Authorization Grant flow to bypass MFA and maintain persistent access to corporate Microsoft 365 environments.
UNC1549, an Iranian-linked APT, targets global aerospace and defense sectors using fake career portals to deliver custom malware including MiniJunk and MiniBrowse.
An attacker used display-name impersonation and same-day registered domains to bypass standard email authentication and deliver a curiosity-based photo lure.
State-sponsored and cybercriminal actors are utilizing ClickFix Payload-as-a-Service (CPaaS) to deliver dynamically obfuscated malware via fake CAPTCHA social engineering and stealthy clipboard injection.
The Russia-aligned Gamaredon group significantly updated its arsenal in 2025, deploying six new PowerShell tools and leveraging legitimate cloud services and tunnels to target Ukrainian military and government institutions.
Lazarus-linked North Korean actors are targeting software developers via hijacked npm/Go packages and fraudulent job interviews to deploy the InvisibleFerret infostealer.
SystemBC is a Windows-based malware family used as a SOCKS5 proxy and persistent RAT by major ransomware groups to tunnel malicious traffic and execute payloads.
Threat actors are using personal Gmail accounts and short.gy URL shorteners to deliver bilingual legal-threat lures for credential harvesting.
A phishing campaign forges a long-standing healthcare sender's identity to deliver multi-hop redirect links via abused SaaS platforms for credential harvesting.
