DEV Community

#threatintel

Gathering, analyzing, and applying intelligence about threats and threat actors.

Posts

đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.
SCKit: ScreenConnect Panels Abused via Blank RMM+ Access Keys to Deploy Rogue Clients and Cookie Relays to 288 Endpoints

SCKit: ScreenConnect Panels Abused via Blank RMM+ Access Keys to Deploy Rogue Clients and Cookie Relays to 288 Endpoints

Comments
7 min read
CSP Credential Theft Without JavaScript via Missing form-action or Allowed Same-Page Submissions, meta refresh, and Referer

CSP Credential Theft Without JavaScript via Missing form-action or Allowed Same-Page Submissions, meta refresh, and Referer

Comments
5 min read
Post-Training Supply Chain Attacks on Coding Agents: Planting Tool-Execution Backdoors via Dataset and Checkpoint Poisoning

Post-Training Supply Chain Attacks on Coding Agents: Planting Tool-Execution Backdoors via Dataset and Checkpoint Poisoning

Comments
7 min read
CL-STA-1238: 25 Autonomous Attacks Using Cairn; Unauthorized Access or Data Retrieval Confirmed at 10 Organizations

CL-STA-1238: 25 Autonomous Attacks Using Cairn; Unauthorized Access or Data Retrieval Confirmed at 10 Organizations

Comments
7 min read
wfx: CI Secret Stealer Pushed to Over 8,900 Repositories via Stolen GitHub Credentials, Aiming for Cloud Persistence

wfx: CI Secret Stealer Pushed to Over 8,900 Repositories via Stolen GitHub Credentials, Aiming for Cloud Persistence

Comments
7 min read
AntiFox: The AWS Breach Where Most Requests Were Denied

AntiFox: The AWS Breach Where Most Requests Were Denied

Comments
1 min read
Operation Snowball: DeepSeek Agent Moves from BroadWorks XXE into a Telecom Provider's Internal Network and Autonomously Adapts to Defenses

Operation Snowball: DeepSeek Agent Moves from BroadWorks XXE into a Telecom Provider's Internal Network and Autonomously Adapts to Defenses

2
Comments
6 min read
Falcon C2: Controlling Browsers and Stealing Passwords and Cookies Through JavaScript on Compromised Websites

Falcon C2: Controlling Browsers and Stealing Passwords and Cookies Through JavaScript on Compromised Websites

2
Comments
6 min read
AntiFox-Linked Activity: IIS Web Shells, Misuse of Stolen AWS Credentials, Secret Retrieval, and S3 Operations

AntiFox-Linked Activity: IIS Web Shells, Misuse of Stolen AWS Credentials, Secret Retrieval, and S3 Operations

2
Comments
6 min read
Microsoft MDASH: Filtering 26,502 AI Scan Results Down to 59 Kernel Bugs and Eight Root Exploits

Microsoft MDASH: Filtering 26,502 AI Scan Results Down to 59 Kernel Bugs and Eight Root Exploits

2
Comments
4 min read
Nitori Breach: 37.6M Records Stolen via Network Compromise

Nitori Breach: 37.6M Records Stolen via Network Compromise

Comments
4 min read
GSocket: Encrypted C2 over Shared Relays and Multi-Layer Persistence Following Public Web Application Compromise

GSocket: Encrypted C2 over Shared Relays and Multi-Layer Persistence Following Public Web Application Compromise

2
Comments
5 min read
Qubole Supply Chain Attack: Vendor IAM Users Abused to Assume Customer AWS Roles, Steal Secrets, and Exfiltrate S3 Data

Qubole Supply Chain Attack: Vendor IAM Users Abused to Assume Customer AWS Roles, Steal Secrets, and Exfiltrate S3 Data

1
Comments
5 min read
Turla Cereal: Hijacks Exchange Transport Agent Handlers to Selectively Steal NATO- and EU-Related Emails

Turla Cereal: Hijacks Exchange Transport Agent Handlers to Selectively Steal NATO- and EU-Related Emails

1
Comments
5 min read
Chrome CVE-2026-125350: XML Use-After-Free Zero-Day Actively Exploited

Chrome CVE-2026-125350: XML Use-After-Free Zero-Day Actively Exploited

1
Comments
4 min read
đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.