Browse public community intelligence reports, source analysis, and threat research.
27 intel reports
GhostCode is a novel phishing kit that abuses the Microsoft Device Code authorization flow to bypass MFA and achieve persistent access to M365 environments.
PREY-0058 (UNC6671) uses help-desk vishing and AiTM phishing to steal Microsoft 365 session tokens for bulk data exfiltration from SharePoint and Exchange via residential proxies.
The Phantom Deal campaign uses impersonation of executives and professional service firms to lure targets into fraudulent M&A transactions via WhatsApp and personal email.
The suspected APT29 group (Cloaked Ursa) launched the Spring Ring campaign targeting over 150 employees with Microsoft Teams-based voice phishing to deploy RMM tools and custom PowerShell RATs.
BREEZE COMET targets Brazilian financial services and payment systems like Pix using a custom multi-language malware suite and AI-accelerated tradecraft.
SynkLoader is a modular Windows malware family distributed via Microsoft Teams phishing that uses a bundled Python environment and in-memory components to facilitate credential theft, tunneling, and remote access.
TWINLOOT is a sophisticated Python implant utilizing SharePoint for tasking, Teams TURN relays for SOCKS5 tunneling, and headless Edge for stealthy Microsoft Graph API transport.
UNC6671 and associated clusters utilize sophisticated vishing and AiTM panels to harvest credentials and exfiltrate data from enterprise cloud and financial platforms.
A threat group named Motions Vics is conducting a global banking phishing campaign using Telegram bots for credential exfiltration and AnyDesk for remote access.
The threat actor STAC4749 uses Microsoft Teams vishing to impersonate IT support, gaining remote access to deploy custom loaders, backdoors, and Chaos ransomware targeting North American organizations.
