DEV Community

#threatintel

Gathering, analyzing, and applying intelligence about threats and threat actors.

Posts

đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.
FaceStealer: Fake Video Conferences and Recorded Footage Used to Induce Self-Infection and Steal Cryptocurrency and Developer Accounts

FaceStealer: Fake Video Conferences and Recorded Footage Used to Induce Self-Infection and Steal Cryptocurrency and Developer Accounts

1
Comments
8 min read
SignDrop: Windows Local Privilege Escalation Chaining CLFS Authentication Files and Defender Update RPC

SignDrop: Windows Local Privilege Escalation Chaining CLFS Authentication Files and Defender Update RPC

1
Comments
4 min read
ImageTragick2: Arbitrary File Read and Write in ImageMagick via SVG and PostScript Processing

ImageTragick2: Arbitrary File Read and Write in ImageMagick via SVG and PostScript Processing

1
Comments
6 min read
PromZard CVE-2026-127109: JavaScript Code Injection via Context Key Source Embedding

PromZard CVE-2026-127109: JavaScript Code Injection via Context Key Source Embedding

1
Comments
4 min read
SilentAir and LIMINAL PANDA: Exploiting SS7, Diameter, and GTP-U Through Compromised Telecommunication Operators

SilentAir and LIMINAL PANDA: Exploiting SS7, Diameter, and GTP-U Through Compromised Telecommunication Operators

1
Comments
7 min read
ComfyUI-Easy-Use CVE-2026-123790: Unauthenticated Path Traversal Leading to Remote Code Execution on Restart

ComfyUI-Easy-Use CVE-2026-123790: Unauthenticated Path Traversal Leading to Remote Code Execution on Restart

1
Comments
4 min read
TightVNC and UltraVNC Viewer CVE-2026-128321: Heap Overflow Caused by Malicious Server

TightVNC and UltraVNC Viewer CVE-2026-128321: Heap Overflow Caused by Malicious Server

1
Comments
5 min read
CSP Credential Theft Without JavaScript via Missing form-action or Allowed Same-Page Submissions, meta refresh, and Referer

CSP Credential Theft Without JavaScript via Missing form-action or Allowed Same-Page Submissions, meta refresh, and Referer

2
Comments
5 min read
CL-STA-1238: 25 Autonomous Attacks Using Cairn; Unauthorized Access or Data Retrieval Confirmed at 10 Organizations

CL-STA-1238: 25 Autonomous Attacks Using Cairn; Unauthorized Access or Data Retrieval Confirmed at 10 Organizations

2
Comments
7 min read
Post-Training Supply Chain Attacks on Coding Agents: Planting Tool-Execution Backdoors via Dataset and Checkpoint Poisoning

Post-Training Supply Chain Attacks on Coding Agents: Planting Tool-Execution Backdoors via Dataset and Checkpoint Poisoning

2
Comments
7 min read
wfx: CI Secret Stealer Pushed to Over 8,900 Repositories via Stolen GitHub Credentials, Aiming for Cloud Persistence

wfx: CI Secret Stealer Pushed to Over 8,900 Repositories via Stolen GitHub Credentials, Aiming for Cloud Persistence

2
Comments
7 min read
SCKit: ScreenConnect Panels Abused via Blank RMM+ Access Keys to Deploy Rogue Clients and Cookie Relays to 288 Endpoints

SCKit: ScreenConnect Panels Abused via Blank RMM+ Access Keys to Deploy Rogue Clients and Cookie Relays to 288 Endpoints

2
Comments
7 min read
AntiFox: The AWS Breach Where Most Requests Were Denied

AntiFox: The AWS Breach Where Most Requests Were Denied

Comments
1 min read
AntiFox-Linked Activity: IIS Web Shells, Misuse of Stolen AWS Credentials, Secret Retrieval, and S3 Operations

AntiFox-Linked Activity: IIS Web Shells, Misuse of Stolen AWS Credentials, Secret Retrieval, and S3 Operations

2
Comments
6 min read
Operation Snowball: DeepSeek Agent Moves from BroadWorks XXE into a Telecom Provider's Internal Network and Autonomously Adapts to Defenses

Operation Snowball: DeepSeek Agent Moves from BroadWorks XXE into a Telecom Provider's Internal Network and Autonomously Adapts to Defenses

2
Comments
6 min read
đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.