Browse public community intelligence reports, source analysis, and threat research.
3 intel reports
A malicious Firefox extension named PDF Identity Verifier uses post-install payload fetching to steal Google session cookies and automate password resets for Portuguese- and Spanish-speaking users.
PolinRider threat actors hijacked two Joyfill npm packages to distribute an obfuscated five-stage malware chain using blockchain-based C2 resolution and a Python credential stealer.
The SuccessKey threat actor is targeting Vite ecosystem developers using malicious scoped npm packages that deliver a Remote Access Trojan (RAT) via a multi-tier blockchain C2 infrastructure.
