Threat Intelligence Center

A threat actor tracked as Doubloon Dredger has been observed abusing Notion to harvest authentication tokens. The activity is associated with a tooling set that includes EvilTokens, Kratos, MailVault and Tycoon2FA.

Red team assessments reveal what a security operations center actually detects, not what its documentation claims. In this comparison of two separate engagements, we walk through how each SOC responded to simulated adversary activity, including tradecraft involving BloodHound.

Mirage2FA intercepts Microsoft 365 logins by proxying the entire authentication flow, capturing both credentials and the session cookie Microsoft issues after 2FA succeeds. ANY.RUN's research links the toolkit to 4,532 organizations between 2024 and 2026, with 48% of targeted email addresses potentially compromised.

WordlistLoader has been observed delivering Amatera Stealer through ClickFix-style prompts, while SynkLoader takes a more direct route by phishing Windows account passwords from the user.

Cryptocurrency fraud rarely happens as a single event. It runs as a pipeline, with distinct stages that hand victims and funds from one step to the next. This analysis examines Operation ASTERIX and the anatomy of that pipeline, following how the operation is assembled and how each stage supports the one after it.

Attackers are infecting Android car head units with malware that enrolls the devices into a proxy botnet, using automotive infotainment hardware as traffic relay infrastructure. The activity is associated with the MoYu threat actor and a toolset that includes BTMOB RAT, BadBox, Evooo1Bot, JarService, Manic, NetNut, TWCore and zhima.