Browse public community intelligence reports, source analysis, and threat research.
27 intel reports
ShinyHunters is targeting healthcare organizations using vishing to compromise SSO identities (Entra, Okta, Google) for rapid SaaS data exfiltration and extortion.
The Payouts King actor targets corporate environments using Microsoft Teams vishing and Quick Assist to deploy a multi-variant Go-based backdoor named GoGRPC.
The threat actor ShinyHunters and affiliated clusters are targeting SaaS platforms, specifically Salesforce, using vishing and OAuth integration abuse for data exfiltration and extortion.
The Helix data extortion group uses social engineering and device code phishing to hijack Microsoft 365 accounts and exfiltrate sensitive SharePoint data.
The threat actor O-UNC-066 is using vishing and a real-time operator-controlled phishing kit to trick users into enrolling attacker-controlled passkeys for Microsoft 365 access.
The O-UNC-066 threat actor is targeting Microsoft 365 users through vishing and real-time phishing panels to hijack Entra passkey enrollment for data extortion.
BlackSuit affiliates use Microsoft Teams vishing and email bombing to deploy Nimbus RAT, a Java-based malware abusing Google Drive for C2.
