Browse public community intelligence reports, source analysis, and threat research.
24 intel reports
Armorsteal is a Python-based malware kit delivered via SEO poisoning that exfiltrates browser credentials, Discord tokens, and crypto wallets while deploying hidden XMRig miners.
KGB RAT is a Windows-based Malware-as-a-Service (MaaS) tool providing Remote Access Trojan capabilities, including credential theft, HVNC, ransomware, and cryptocurrency wallet swapping.
Adversaries, including activity sharing infrastructure history with APT29, are exploiting CVE-2026-42589 in Gotenberg to deploy the 'cache_base' Go-based reverse shell and a broader toolkit.
Glassworm threat actors compromised a contributor's GitHub account to replace official OVHcloud CLI release binaries with secret-stealing malware using a Solana-based dead drop for command and control.
UNC7017 conducted ephemeral supply chain tampering against AOMEI Technology update servers to deliver CROSSROAD and SHINYROAD malware via short-burst configuration modifications.
Transparent Tribe (APT-C-56) utilizes ISO/ZIP-based lure files and LNK execution chains to deploy CrimsonRAT and a custom Golang-based remote access trojan against Indian and South Asian targets.
BabylonRAT is an open-source Remote Access Trojan (RAT) capable of credential theft, keylogging, and DDoS attacks, recently used in campaigns targeting public institutions in Malaysia.
A self-proclaimed bug bounty hunter utilizes LLM-generated JavaScript malware named PhantomRaven to compromise developer environments via typosquatted npm packages for credential theft.
The NinjaMare campaign uses typosquatted domains and MSIX installers to deliver a remote-controlled input injection engine disguised as a privacy browser.
Lazarus Group's Famous Chollima unit utilizes stolen identities and AI-assisted workflows to infiltrate Western finance and technology firms as remote IT workers.
