Threadlinqs Intelligence — Real-Time Threat Detection Platform

Threadlinqs Intelligence is a free, public cyber-threat-intelligence platform for security operations, detection engineering and threat-hunting teams. Every entry is a profiled real-world threat: what the adversary did, which MITRE ATT&CK techniques it maps to, which CVEs it exploited, which indicators it left behind, and the detection rules that catch it. It currently profiles 2,831 threats, each carrying deployable detection logic — 25,918 rules in Splunk SPL, Microsoft KQL and Sigma — alongside 70,279 extracted indicators of compromise, 668 attributed threat actors and 858 distinct MITRE ATT&CK and ATLAS techniques. The corpus is updated daily. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Data as of .

Explore

Recent threat intelligence

  1. Full-chain Chrome exploit (V8 Maglev, WebP CVE-2026-85045, Crashpad CVE-2026-78952) built with GPT-5.6 Sol by XBOW earns $250,000 Google bounty — HIGH, added
  2. KGB RAT: NjRAT-based Windows Trojan sold as MaaS with FUD crypter — HIGH, added
  3. Meta GitHub Repositories Breached via Stolen Employee Credentials; Source Code and Personal Data of ~1,500 People Stolen — MEDIUM, added
  4. Attackers Breach European Bank Through Third-Party Gateway and Target WSUS Server — HIGH, added
  5. AgentTesla Infostealer Distributed via Business Proposal Phishing Emails (Fake Café Management Software) — MEDIUM, added
  6. Multiple Google Chrome Flaws Could Enable Memory Corruption and Code Execution Attacks (37 vulnerabilities patched, 7 critical; fixed in Chrome 155.0.8059.79) — CRITICAL, added
  7. SilkParasite: China-Nexus APT Campaign Targeting Central Asian Governments with Seven RAT Families — HIGH, added
  8. Windows BitLocker Vulnerabilities: Security Feature Bypass and Privilege Elevation (CVE-2026-85920, CVE-2026-88070, CVE-2026-83500) — HIGH, added
  9. XWorm Leaked Builder Spawns Surveillance-Capable RAT Variants (V6.4, V6.5 'XWorm Reborn', V7.2, V7.4) — HIGH, added
  10. Microsoft Observed 7.6 Billion Phishing Emails in Q2 2026: Credential Phishing, BEC Surge and Teams-Based Phishing Growth — MEDIUM, added
  11. Coruna and DarkSword iOS Exploit Kits Compromise iPhones via Single Malicious Website (UNC6353, UNC6691, UNC6748, PARS Defense) — HIGH, added
  12. Ransomware Actors Escalate to Personal Intimidation and Physical Threats Against Victim Staff (Semperis 2026 Ransomware Risk Report) — MEDIUM, added
  13. Phonescams (TOAD): Email-Spoofed Brand Impersonation Driving Victims to Scam Phone Numbers — MEDIUM, added
  14. North Korean IT Worker Laptop Farms in Texas Disrupted by DOJ (Operation Lonestar Roundup) — $3M Revenue from 70+ U.S. Companies — HIGH, added
  15. Anthropic Frontier Red Team research: small open-weight AI models approaching ability to self-replicate across consumer IoT devices (Android TV boxes) — LOW, added
  16. CISA KEV Adds Two Vulnerabilities: Microsoft Windows Shell Command Injection (CVE-2026-96951) and Ivanti Connect Secure Authentication Bypass by Spoofing (CVE-2026-104935) — CRITICAL, added
  17. Insider Threat: OpenAI Engineer Arrested for Planting Hidden Audio Recording Device in Executive Conference Room — MEDIUM, added
  18. Q3 2026 Malware Campaigns Targeting Windows Database Servers (MS-SQL/MySQL) - XMRig, Web Shells, VShell, Remote Access Tools — MEDIUM, added
  19. Linux SSH Server Attacks Deploying ShellBot, Fisieredoor, XHide Rootkit and XMRig (AhnLab ASEC Q3 2026 Report) — HIGH, added
  20. September 2026 CVE Landscape: 94 high-impact vulnerabilities, NetScaler zero-days CVE-2026-88771/CVE-2026-88772, AI-agent-assisted exploitation — CRITICAL, added
  21. October 2026 Microsoft Patch Tuesday: Exploited Windows Shell MotW Bypass (CVE-2026-96951), 1,417 Vulnerabilities Patched — CRITICAL, added
  22. Microsoft October 2026 Patch Tuesday: 1,118 Vulnerabilities Fixed, Grouped into 15 Risk Cohorts — MEDIUM, added
  23. XWorm RAT (V6.4-V7.4): Microphone Surveillance and Logged-In Browser Session Hijacking — HIGH, added
  24. Critical FortiSandbox GUI Authentication Bypass (CVE-2026-107656) — CRITICAL, added
  25. Adobe Patches ~140 Vulnerabilities Across 10 Products (ColdFusion, Content Credentials SDK, Photoshop, Commerce, others) — HIGH, added
  26. MFA Coverage Gaps (Cloud-only MFA, VPN, RDP, Windows Logon) Exploited with Stolen Credentials - Akira Affiliate SonicWall VPN Intrusion (Aug 2026) — MEDIUM, added
  27. VerCellBreak: Vercel Sandbox network-allowlist bypass lets rogue AI agents exfiltrate data via crafted mTLS client certificate AIA extension (no CVE assigned) — HIGH, added
  28. Zoom Clients Certificate Validation Flaws (CVE-2026-108184, CVE-2026-108185) Expose Sensitive Information via Network Access — HIGH, added
  29. Ivanti Connect Secure Authentication Bypass by Spoofing Zero-Day (CVE-2026-104935) Exploited in the Wild — CRITICAL, added
  30. Docker Hub personal access token reassignment flaw (CVE-2026-105445, "GhostPAT") enables user impersonation and image tampering — CRITICAL, added

From the blog

Browse the corpus

  • Threat actors — every tracked adversary with its threats, techniques and targets
  • CVEs — enriched vulnerabilities with CVSS, EPSS and CISA KEV status
  • ATT&CK techniques — every MITRE technique seen in the corpus and the threats that use it
  • Vendors — affected vendors and the threats and CVEs tied to them
  • Weaknesses (CWE) — software weakness classes and the CVEs that instantiate them
  • Daily debriefs — the archive of daily threat-intelligence briefings

Machine-readable overview: /llms.txt.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level
Fig. 01 · Threat weatherIndexing the archive…
1 square = 1 threat · click to open

Latest Threats