When opportunity (malware) comes a-knocking, you let it in (fire up the sandbox and disassembler). #malware #ThreatIntel #ThreatIntelligence #IFIN

Tell your friends. Mess around with the single field we ask for during onboarding, and we will toss you. If you don't take this seriously, we have no reason to expect you to respect our community's safety.

We've been on a tear adding new sources to our RSS aggregator! All the cyber news that's fit to print, in one place: news.ifin.network

Bitwarden's CLI NPM package was hijacked and used to spread credential stealer malware. This is related to the previous Checkmarx compromise. We'll be updating this thread as always with new information. Come join the effort!

The best time to block api.telegram[.]org was like, I dunno, five years ago? The second best time to do it is now. Seriously. Cross that one off the easy wins list today. #ThreatIntel #ThreatIntelligence #IFIN

Thanks to some excellent reporting from Infostealers by Hudson Rock, we know a context[.]ai employee was seeking Roblox cheats when they got hit with LummaStealer, leading to the initial breach which impacted Vercel. discourse.ifin.network/t/vercel-con...

Today we're talking about another (???) issue in the Cursor AI IDE. Well actually it's two issues, one of which is simple command injection; the other is takeover via Dev tunnels. Don't know what dev tunnels are? Come find out—then block them with extreme prejudice.

Today we're talking about another (???) issue in the Cursor AI IDE. Well actually it's two issues, one of which is simple command injection; the other is takeover via Dev tunnels. Don't know what dev tunnels are? Come find out—then block them with extreme prejudice.

#Vercel update. We now know, thanks to Vercel's CEO, that the compromise came by way of the context[.]ai Office Suite, using OAuth tokens collected from a breach last month. Details here:

We're actively tracking developments here: discourse.ifin.network/t/vercel-con...

#Vercel customers: don't wait. Proactively rotate keys, passwords and environment variables ASAP. vercel.com/kb/bulletin/...

#Vercel customers: don't wait. Proactively rotate keys, passwords and environment variables ASAP. vercel.com/kb/bulletin/...

👀👀👀

We've been tracking #Iran cyber activity since the beginning of March, consolidating high-value intelligence into a single thread. One of the most comprehensive resources on the topic, if we do say so ourselves.

After working on it a bit, we have a fix for a recent #ClickFix attack against #macOS that leverages AppleScript. Here's the writeup, and a link to the forum thread! ifin-intel.org/blog/...#ClickFix#macOS#ThreatIntel ThreatIntelligence #IFIN

After working on it a bit, we have a fix for a recent #ClickFix attack against #macOS that leverages AppleScript. Here's the writeup, and a link to the forum thread! ifin-intel.org/blog/...#ClickFix#macOS#ThreatIntel ThreatIntelligence #IFIN

Following up on an excellent blog post we discovered (linked in thread), we dug a little deeper on a recent #WordPress plugin compromise. We have more IoCs, and evidence of initial access auctions via the blockchain. discourse.ifin.netwo...#WordPress #ThreatIntel #ThreatIntelligence #ThreatHunting #IFIN

Following up on an excellent blog post we discovered (linked in thread), we dug a little deeper on a recent #WordPress plugin compromise. We have more IoCs, and evidence of initial access auctions via the blockchain. discourse.ifin.netwo...#WordPress #ThreatIntel #ThreatIntelligence #ThreatHunting #IFIN

CISA is claiming that #Iran is once again targeting Programmable Logic Controllers (PLCs), similar to efforts in 2024. Has anyone seen recent evidence of this? None was provided from CISA, and we'd love independent confirmation.

We are thrilled to announce that we have taken over operation of one of the most useful open cyber news aggregators around. @taggartinstitute.org has gifted us their FreshRSS instance, which is now available at http://news.ifin.net....

We are thrilled to announce that we have taken over operation of one of the most useful open cyber news aggregators around. @taggartinstitute.org has gifted us their FreshRSS instance, which is now available at http://news.ifin.net....

We ask for preferred pronouns when you register. We do this so everyone can address you how you wish. But it's also a signal of how you'll treat others.

Update: Adobe has a patch out! helpx.adobe.com/security/pro... And an associated CVE: CVE-2026-34621

CPUID downloads were temporarily compromised earlier today. We have a thread compiling analysis and IoCs for you to investigate: discourse.ifin.netwo... #ThreatIntel #IFIN #ThreatIntelligence

We've been tracking this Adobe 0-day in Acrobat Reader. Still no patch from Adobe (and no word on affected versions). Per the discoverer, this attack has been ongoing for months. discourse.ifin.netwo... #Adobe #0day #ThreatIntel #IFIN

CPUID downloads were temporarily compromised earlier today. We have a thread compiling analysis and IoCs for you to investigate: discourse.ifin.netwo... #ThreatIntel #IFIN #ThreatIntelligence

Minor programming note: I'm going to probably push most of the threat intelligence material I usually post through @ifin-intel.org , so it's a clear channel for actionable information.

This right here? This is a huge part of why we exist. It's time to trust in each other for our mutual protection, because nobody is coming to save us.

Looks like we have a live one here. Weird Rust maintainer phishing campaign using `crates[.]ws`: discourse.ifin.network/t/bizarre-cr...

Our AI Policy. Sorry not sorry: "With so many downside risks, and with such dubious benefit to usage, the choice for IFIN is clear: we choose not to participate in the toxic cult of generative AI. Our published material and code are not produced with these models." ifin-intel.org/policies/ai/

I've been part of IFIN (in the background) for several months, talking cyber and sharing intel. @taggart-tech.com hooked me with this premise: threat intelligence *is* mutual aid. So for what it's worth, I'm there and in for the long haul. Come join us.

CISA just published an advisory about IRGC activity against Rockwell/Allen-Bradley PLCs. This is a return to form for IRGC, following patterns observed in 2023. discourse.ifin.network/t/iran-confl...

And our first contribution: here is our thread on currently tracked #Iran-based cyber threat activity, including motivations and targeting information. discourse.ifin.network/t/iran-confl...

This has been a year in the making. As Executive Director of IFIN, I'm very excited for what's coming. Join us!

Hello world! We are IFIN, the Independent Federated Intelligence Network, and we want to change how threat intelligence is done. We believe we're all safer when we share what we know. Come learn more and join us! ifin-intel.org/blog/hello/ #ThreatIntel #ThreatIntelligence #Cybersecurity #Infosec