Browse public community intelligence reports, source analysis, and threat research.
7 intel reports
Threat actors abuse Microsoft Teams external chat to pose as IT support, using email bombing and vishing to deploy remote access tools and malware.
Threat actors Storm-3121 and Storm-3032 utilize passkey-themed social engineering and AiTM phishing to compromise Microsoft cloud identities for automated data exfiltration via Microsoft Graph.
An unattributed threat actor launched a mass ACH fraud campaign using AI-assisted templates to impersonate executives and vendors, targeting accounts payable departments with highly personalized lures.
The Phantom Deal campaign uses impersonation of executives and professional service firms to lure targets into fraudulent M&A transactions via WhatsApp and personal email.
The AnonyMousKIT PhaaS platform utilizes AI voice agents and multi-channel phishing to harvest Apple ID credentials, enabling the removal of Activation Lock on stolen devices.
Lazarus Group's Famous Chollima unit utilizes stolen identities and AI-assisted workflows to infiltrate Western finance and technology firms as remote IT workers.
Myxa VPN operates 737 malicious Chrome extensions impersonating 66 privacy brands to redirect all user browser traffic through controlled SOCKS5 proxies.
