Trends

Chokepoints stay stable; the techniques around them shift. Track what's actually prevalent - payloads, evasion, infrastructure.

Payload Prevalence
Which command lines, scripts, and file types are most common vs. rare across real-world campaigns
Technique Shifts
When adversaries pivot. New evasion methods emerging, old ones dying as defenders catch up.
Malicious Infrastructure
Staging domains, CDN abuse, C2 hosting patterns, and reused infrastructure clusters
Time-Series Intel
Monthly aggregations showing acceleration, plateau, or decline, not just point-in-time snapshots

Analyses

ClickFix Delivery Chain
Live Data

10 months of MHaggis ClickGrab crawl data mapped through the Detection Chokepoint Framework. Tracks cradle family evolution (IWR→Curl pivot), evasion technique acceleration (Base64 18×), self-delete emergence, and CDN staging infrastructure across 20K+ malicious sites.

25607 sites crawled 22214 malicious 534 daily reports 2025-04-17 to 2026-06-29
Updated 2026-06-29 View analysis
Edge Device Exploit Trends
Live Data

Defused Cyber honeypot telemetry across 25 edge device decoy types mapped through the Detection Chokepoint Framework. Tracks CitrixBleed 2 toolkit proliferation (54% of traffic), the CVE-2022-22536 SAP burst, CVE-2026-20127 (Cisco SD-WAN) full kill chain, and self-replicating worm campaigns.

15,001 exploit attempts 25 decoy types 40+ CVEs Mar 14 – Apr 13, 2026
Updated 2026-04-13 View analysis
Software Impersonation Infrastructure
Live Data

Validated de-intel-pipeline hunts plus aggregate IOC pipeline data. Tracks favicon-pivot discovery, JS-gated EXE delivery (MROScanner OU cert), ClickFix install modals targeting AI developer tools, and post-launch domain squatting against Codex CLI and LM Studio.

5 validated hunts 5 brands 2 confirmed delivery 1569 pipeline records 2026-02-15 to 2026-05-17
Updated 2026-06-13 View analysis

Have data worth analyzing? Trends analyses are sourced from crawled infrastructure, public incident reports, and open datasets. If you have a dataset that maps well to detection chokepoints, see CONTRIBUTING.md or open an issue to discuss.