Browse public community intelligence reports, source analysis, and threat research.
123 intel reports
A sophisticated AiTM phishing campaign utilizes the PoisonSeeds kit to harvest AWS console credentials and bypass MFA via real-time challenge relaying.
An active phishing campaign targets hospitality organizations in Europe and Asia using photo-themed ZIP files to deliver a Node.js-based implant called TonRAT.
Pony is a long-standing credential stealer and downloader that targets various applications and uses dictionary attacks against local Windows accounts to deliver second-stage payloads like ZeuS.
The MexicanMafia threat actor, also known as PanchoVilla, is conducting a sophisticated campaign using the Kimera reconnaissance engine and custom exploits against perimeter devices in Latin America.
An invoice fraud campaign uses legitimate Upflow.io tokens and spoofed subdomains to bypass authentication and capture payments via fraudulent IBANs.
A critical vulnerability chain named SearchLeak allows attackers to exfiltrate sensitive Microsoft 365 data via a single-click URL exploit targeting Copilot Enterprise Search.
The Storm-1747 threat actor uses the Tycoon 2FA AiTM phishing kit to bypass multi-factor authentication and maintain persistence in Microsoft 365 and Google Workspace environments.
KongTuke and PS1Bot campaigns leverage malicious browser extensions and malvertising to deliver modular RATs and information stealers targeting Windows and macOS systems.
Storm-1747 utilizes Tycoon 2FA to bypass MFA and maintain persistence through device registration and session token theft targeting Microsoft and Google cloud environments.
The EvilTokens Phishing-as-a-Service leverages Microsoft device code authentication flows and AI-driven automation to exfiltrate tokens and orchestrate large-scale Business Email Compromise (BEC) attacks.
