Threat Intelligence

What we're seeing in the wild.

Incident response is a goldmine for up-to-date threat actor tactics and techniques. Read about what we're seeing, and how businesses can protect themselves.

Latest research

Threat intelligence library

Flowchart showing mailbox compromise and ClickFix infostealer phishing attack paths.

Cyber threat intelligence

Protecting Against Modern Phishing

Modern phishing no longer always looks fake. This guide explains how mailbox-led attacks, SharePoint lures, device code phishing and ClickFix pages work, and what organisations should train, block and monitor.

Jun 1, 202611 min readRead

Threat Intelligence

Threat Actor Tradecraft – The Residential Proxy Problem

Threat actors are moving from VPNs to residential proxies, routing attacks through ordinary home connections. How they work, and how Strand now detects them.

Will Poole and Jordan Newman

Oct 6, 20266 min readRead

Threat Intelligence

Vibe-Coded Malware: How Working Apps Become Infostealers

Threat actors ship working, often AI-built apps that turn malicious through an update. We cover TamperedChef, CHOSEN BRICK and NightScreenShot, with IOCs.

Jordan Newman

Oct 1, 202613 min readRead

Threat Intelligence

Trivy / TeamPCP - How to check if you're exposed

Strand Intelligence has released a free, open-source scanner to detect exposure to the TeamPCP supply chain attack (CVE-2026-33634) — one of the most significant software supply chain compromises of 2026. If your organisation uses Trivy, GitHub Actions, LiteLLM, or any of 66+ compromised npm packages, run this tool to find out in minutes whether your credentials, infrastructure, or developer machines were affected.

Will Poole

Mar 25, 20265 min readRead

See more threat intelligence

Loading threat intelligence articles…