Browse public community intelligence reports, source analysis, and threat research.
123 intel reports
Adversaries are globally leveraging the ClickFix social engineering technique to trick Windows and macOS users into executing malicious terminal commands that deliver infostealers and RATs.
The threat actor Storm-2755, also known as Payroll Pirates, uses adversary-in-the-middle (AiTM) phishing and residential proxies to compromise Microsoft 365 accounts for targeted financial data collection.
Storm-2755 (Payroll Pirates) uses AiTM phishing and residential proxies to compromise Microsoft 365 accounts for financial data theft and payroll diversion.
Cymulate Research Lab identified a stored cross-site scripting (XSS) vulnerability in Microsoft Purview Communication Compliance that allows external attackers to steal session tokens and achieve account takeover of compliance analysts.
Cybercriminals are stealing AI API tokens using supply chain attacks and infostealers to fuel gray-market 'transfer station' proxy services, causing massive financial losses.
The SMOKE#SCREEN campaign utilizes diverse social engineering lures and aggressive security-dismantling toolsets to deploy persistent ScreenConnect RMM agents on Windows and macOS systems.
UNC6692 uses email bombing and IT impersonation via Microsoft Teams to deploy the Edgecution/SNOW malware suite and facilitate ransomware access.
A state-sponsored threat group and Gunra ransomware actors exploited vulnerabilities in South Korean financial security software like AnySign4PC to deploy SIGNBT and COPPERHEDGE backdoors via watering holes.
Attackers are using cloned greeting-card templates with globally rewritten anchors to deliver ScreenConnect remote-access installers targeting healthcare data-protection roles.
Threat actors are utilizing fake software updates and gaming cheats to deploy ScreenConnect RMM agents and the Powercat Java stealer for persistent access and credential theft.
