Browse public community intelligence reports, source analysis, and threat research.
123 intel reports
Midnight Blizzard-linked actor GTG-20006 utilized AI-assisted code generation to modify PowerShell stagers and Go backdoors targeting government and defense organizations via device-code phishing.
Threat actors are increasingly using AI-powered Phishing-as-a-Service (PhaaS) kits like the Jalisco toolkit to bypass MFA via device code phishing and OAuth token harvesting.
Akira ransomware targets global organizations across Windows and Linux platforms using double extortion, vulnerability exploitation, and credential theft.
An unidentified threat actor utilizes renamed Python interpreters and custom ._pth files to execute malicious code without command-line arguments, eventually attempting to deploy ScreenConnect via a UAC bypass.
Earth Sirrush (UAC-0099) utilizes evolving .NET malware, steganographic delivery, and trojanized applications to target Ukrainian government and logistics sectors for long-term espionage.
The Kali365 Phishing-as-a-Service platform exploits Microsoft's device code authentication flow to bypass MFA and capture persistent OAuth tokens for M365 environments.
Mir0Auth is a sophisticated phishing kit that abuses the Microsoft OAuth device authorization grant to harvest session tokens and bypass MFA.
China-aligned threat actor TA419 is conducting credential phishing campaigns against AI policy experts at US think tanks and universities using advanced AitM techniques.
Attackers exploited an HTML injection vulnerability in xAI's email invite template to send malicious links from legitimate x.ai domains.
The threat actor UAT-11985 is targeting Taiwan research organizations using AI-generated spear-phishing lures and QR codes to drive victims toward an Adversary-in-the-Middle (AitM) framework for harvesting Google account credentials and MFA codes.
