Browse public community intelligence reports, source analysis, and threat research.
50 intel reports
The Miasma threat actor is deploying a self-spreading npm worm that utilizes a 'Phantom Gyp' technique to execute code during installation, targeting cloud credentials and AI coding assistants.
FAMOUS CHOLLIMA (DPRK) distributes the MicrosoftSystem64 RAT via malicious npm packages, leveraging HuggingFace for binary updates and data exfiltration.
The TeamPCP threat group is conducting a large-scale supply chain campaign using the 'Mini Shai-Hulud' worm to compromise npm packages, steal CI/CD and cloud credentials, and autonomously propagate.
The ClickFix campaign has evolved to deploy PySoxy, an open-source Python SOCKS5 proxy, for redundant encrypted C2 access and persistence following initial social engineering.
The TeamPCP campaign hijacked the @bitwarden/cli npm package to distribute a sophisticated stealer targeting developer credentials, cloud secrets, and AI configuration files.
North Korean state actor Sapphire Sleet targets cryptocurrency and finance sectors using social engineering and multi-stage AppleScript-based infection chains on macOS.
The threat actor UAT-10362 is targeting Taiwanese NGOs and universities with a modular Lua-based stager called LucidRook and a reconnaissance tool named LucidKnight.
Multiple China-aligned threat actors, including Stately Taurus and clusters CL-STA-1048/1049, are targeting a Southeast Asian government using a diverse toolkit of USB-propagated malware, novel loaders, and remote access Trojans.
Threat actor TeamPCP compromised the Trivy vulnerability scanner and associated GitHub Actions to exfiltrate cloud and CI/CD credentials via poisoned tags and binaries.
The threat actor TeamPCP compromised Aqua Security's Trivy project, injecting credential-stealing malware into official releases and forcing malicious updates to GitHub Actions.
