Browse public community intelligence reports, source analysis, and threat research.
11 intel reports
Threat actors abuse Microsoft Teams external chat to pose as IT support, using email bombing and vishing to deploy remote access tools and malware.
SkyW4lker is a device-code phishing kit targeting Microsoft 365 users, primarily in the US technology and manufacturing sectors, to bypass MFA and obtain access tokens.
ShinyHunters (UNC6240) is targeting healthcare through identity-access extortion using vishing/AitM kits and mass exploitation of CVE-2026-35273 in Oracle PeopleSoft.
An unattributed threat actor launched a mass ACH fraud campaign using AI-assisted templates to impersonate executives and vendors, targeting accounts payable departments with highly personalized lures.
The AnonyMousKIT PhaaS platform utilizes AI voice agents and multi-channel phishing to harvest Apple ID credentials, enabling the removal of Activation Lock on stolen devices.
An attacker targeted hardware wallet users using a typosquatted Ledger domain laundered through an Australian venue's authenticated transactional email infrastructure.
Adversaries abused a legitimate ServiceNow enterprise ticketing tenant to solicit sensitive financial and vendor verification data from a marine equipment manufacturer via reply-only phishing.
Attackers are impersonating Interactive Brokers using a tax-themed W-8BEN expiration lure and 0-day domains to harvest credentials from healthcare sector employees.
Attackers are abusing the OAuth 2.0 device authorization grant to trick users into authenticating malicious sessions on legitimate Microsoft sign-in pages, bypassing MFA.
An attacker used display-name impersonation and same-day registered domains to bypass standard email authentication and deliver a curiosity-based photo lure.
