Browse public community intelligence reports, source analysis, and threat research.
123 intel reports
The Kratos Phishing-as-a-Service (PhaaS) platform targets Microsoft 365 credentials in the US and Europe using sophisticated multi-generation phishing kits and anti-bot measures.
The DEBULL PhaaS framework leverages Microsoft device-code phishing and the GraphSpy post-exploitation tool to compromise Microsoft 365 tenants using Storm-2372-style tradecraft.
The Forg365 Phishing-as-a-Service platform utilizes AI-assisted lures, device-code flow abuse, and a custom browser extension to compromise and maintain access to Microsoft 365 environments.
A logistics-themed spear-phishing campaign deploys CrySome RAT via a multi-stage chain involving UAC bypass, AMSI patching, and the WinDefCtl utility to disable endpoint defenses.
The Helix data extortion group uses social engineering and device code phishing to hijack Microsoft 365 accounts and exfiltrate sensitive SharePoint data.
The EvilTokens and ARToken Phishing-as-a-Service (PhaaS) platforms use Microsoft Device Code flows and browser-side decryption to bypass MFA and achieve persistent Microsoft 365 account takeovers.
ARToken is an EvilTokens-linked Phishing-as-a-Service platform that uses Microsoft OAuth Device Code grants to capture Primary Refresh Tokens (PRTs) for persistent access and BEC operations.
A China-nexus threat actor is targeting Indian taxpayers and government infrastructure using a multi-stage infection chain to deploy DcRAT via fake tax utility lures.
The O-UNC-066 threat actor is targeting Microsoft 365 users through vishing and real-time phishing panels to hijack Entra passkey enrollment for data extortion.
LSHIY LLC linked actors conducted a massive password spray campaign targeting Azure CLI to bypass MFA via ROPC, while new vulnerabilities in AI agents like Amazon Q Developer emerged.
