Browse public community intelligence reports, source analysis, and threat research.
9 intel reports
Chinese-speaking actor leepsmarts executes the KeyHunter Operation, stealing 2,233 LLM API keys and orchestrating an academic fraud campaign targeting 20 universities.
Threat actors Storm-3121 and Storm-3032 utilize passkey-themed social engineering and AiTM phishing to compromise Microsoft cloud identities for automated data exfiltration via Microsoft Graph.
An unattributed threat actor launched a mass ACH fraud campaign using AI-assisted templates to impersonate executives and vendors, targeting accounts payable departments with highly personalized lures.
The AnonyMousKIT PhaaS platform utilizes AI voice agents and multi-channel phishing to harvest Apple ID credentials, enabling the removal of Activation Lock on stolen devices.
Gray-market services like Poison Claude and Ecomagent exploit cloud promotional credits and synthetic identities to resell discounted, proxied access to frontier AI models.
Attackers compromised Adform's advertising tracking script trackpoint-async.js to replace cryptocurrency wallet addresses in user clipboards and web forms.
Turla (Secret Blizzard) targets government and military entities globally using the custom STOCKSTAY and Kazuar backdoors, often leveraging hijacked infrastructure.
Researchers from AIR created a fake AI agent skill named brand-landingpage that bypassed multiple security scanners to reach 26,000 agents by hosting malicious instructions on an external domain.
Threat actors are increasingly abusing native Microsoft 365 mailbox rules to maintain persistence, suppress security alerts, and automate data exfiltration following account compromise.
