Find what you’re looking for
Browse everything
6,857 results in Threat Reports
Multi-Stage AWS Attack: From SSRF to Unauthorized AI Model Access
A sophisticated multi-stage attack demonstrated how web application vulnerabilities can cascade into unauthorized AI service access across AWS regions. The incident began with a Server-Side Request Forgery (SSRF) vulnerability in a web application that allowed attackers to exploit IMDSv1 endpoints and harvest temporary AWS credentials from an EC2 instance's webdev role. Using these compromised credentials, the threat actor conducted permission boundary testing, established console access without MFA, and ultimately pivoted to Amazon Bedrock services across multiple regions, successfully invoking AI models and consuming computational resources. This attack chain highlights critical gaps in cloud security architecture, particularly the dangerous combination of overprivileged IAM roles, legacy metadata service configurations, and inconsistent cross-region security controls that enabled lateral movement from a simple web vulnerability to unauthorized AI infrastructure access.
Massive Identity Verification Breach: 153M Driver's Licenses Compromised at IDScan.net
In September 2026, a new identity theft service called Nexus launched on the dark web selling digital scans of over 153 million drivers licenses from the United States and Canada. The breach appears to originate from Louisiana-based identity verification company IDScan.net, which provides services to major clients including Hertz, Target, FedEx, and numerous marijuana dispensaries. The stolen data includes infrared and ultraviolet scans with timestamps indicating continuous exfiltration over more than a year, prompting an FBI investigation by the New Orleans field office. This massive identity document breach represents one of the largest exposures of state-issued identification data in U.S. history, with attackers offering licenses of high-profile government officials including Defense Secretary Pete Hegseth and FBI leadership. The incident highlights critical vulnerabilities in third-party identity verification systems that process over 21 million verifications monthly across 20,000 locations worldwide.
The AI Vulnerability Surge: Why 2026's 'Vulnpocalypse' May Be More Manageable Than Expected
New research from Echo analyzing nearly 40,000 CVE lifecycles reveals that while AI tools like Anthropic's Claude Mythos have dramatically accelerated vulnerability discovery, the anticipated 'Vulnpocalypse' may be more manageable than feared. Monthly CVE disclosures surged 145% from June 2024 to June 2026, rising from 3,173 to 7,765, with AI enabling exploit development in under one day for less than $2,000. However, fewer than 10% of AI-discovered vulnerabilities receive external validation, and most critical ratings are downgraded upon review. The study found that 89% of examined vulnerabilities already have fixes available, but 40% remain unpatched for over six months due to deployment challenges rather than fix availability. Organizations can better manage this surge by focusing on rapid validation, intelligent prioritization, and automated remediation processes rather than completely overhauling their vulnerability management programs.
The AI Cybercrime Revolution: How Artificial Intelligence Tilts the Playing Field Toward Attackers
In 2026, artificial intelligence is fundamentally transforming the cybercrime landscape by dramatically compressing attack timelines and lowering entry barriers for threat actors. Former cybercriminal Brett Johnson, known as the 'original Internet Godfather' by the US Secret Service, demonstrated at Black Hat USA how AI enables attackers to conduct reconnaissance, identify crown jewels, and execute attacks in significantly reduced timeframes. While defenders still operate reactively, AI empowers criminals to automate target research, vulnerability discovery, and even ransomware development without requiring advanced technical skills. This shift is driving more attackers toward critical infrastructure targets like hospitals and schools, where higher payouts justify the risks. The technology's learning-based nature means it benefits attackers more than defenders, as it must observe successful attacks to improve, creating an inherent advantage for malicious actors in the current threat landscape.
Breeze Comet Cybercrime Group: Direct Manipulation of Global Financial Payment Systems
Breeze Comet (formerly UNC5669) represents Brazil's most sophisticated cybercrime group, systematically infiltrating financial institutions across Brazil and expanding globally since 2024. The group employs advanced tactics including insider recruitment, physical network access via rogue hardware, and exploitation of compromised government websites as trusted attack vectors. Using custom malware like CobaltSpin, RealBreeze, and KickPlate, they penetrate segmented financial networks to directly manipulate payment systems including Brazil's Pix instant payment platform, executing hundreds of fraudulent transactions worth tens of thousands of dollars within 24-48 hours of system compromise. This incident highlights the evolution of financially-motivated cybercrime from traditional ransomware and fraud schemes to direct payment system manipulation. As instant payment systems proliferate globally and threat actors increasingly leverage AI for malware development, Breeze Comet's successful model poses significant risks to financial infrastructure worldwide, particularly in regions with similar digital payment architectures.
Critical SonicWall SMA 1000 Zero-Days Under Active Exploitation: CVE-2026-83548 & CVE-2026-83549
In September 2026, attackers began actively exploiting two zero-day vulnerabilities in SonicWall SMA 1000 perimeter devices, enabling unauthenticated remote code execution. CVE-2026-83548, a critical SSRF vulnerability with a CVSS score of 10.0, allows unauthorized access through an unintended alternate access path, while CVE-2026-83549 enables OS command injection. When chained together, these flaws provide complete system compromise of affected appliances running versions 12.4.3-03453/12.5.0-02835 and older. SonicWall confirmed ongoing exploitation and urged immediate patching to versions 12.4.3-03526/12.5.0-02952 or higher. This incident highlights the continued targeting of edge security devices as initial compromise vectors, following a pattern of sophisticated zero-day attacks against network perimeter appliances throughout 2026, emphasizing the critical need for rapid patch management and network segmentation strategies.
Machine Speed Terror: How AI Agents Compressed a 2-Week Breach Into 10 Hours
In September 2026, threat actors demonstrated the devastating potential of AI-assisted cyberattacks by compressing a typical two-week enterprise breach timeline into just 10 hours. The attackers deployed coordinated frontier AI agents that autonomously breached network security layers, harvested credentials, seized root access, hijacked CI/CD pipelines, and weaponized the victim's own AI infrastructure. The attack began with exploitation of a public API endpoint and escalated through systematic extraction of hardcoded tokens from code repositories, ultimately providing master administrative credentials and complete system compromise. This machine-speed ransomware attack represents a paradigm shift from individual AI-assisted tasks to orchestrated multi-agent operations that can outpace traditional security response capabilities. The emergence of AI-driven attack coordination signals a new era where threat actors can achieve enterprise-scale breaches with unprecedented speed and efficiency, forcing organizations to fundamentally reimagine their defense strategies and response timelines.
Seven Critical Vulnerabilities Exploited in Wild: AI Infrastructure Becomes Prime Target
CISA added seven critical vulnerabilities to its Known Exploited Vulnerabilities catalog in September 2026 after observing active exploitation by threat actors. The vulnerabilities span multiple platforms including SonicWall SMA appliances, Sangoma Switchvox, JFrog Artifactory, and AI infrastructure components like LiteLLM and Kestra. Attackers exploited these flaws to deploy reverse shells, cryptocurrency miners, and conduct unauthorized operations, with campaigns targeting AI infrastructure becoming increasingly prominent as adversaries seek to harvest API keys and monetize compromised systems. This incident highlights the growing threat landscape targeting AI infrastructure and the critical importance of rapid vulnerability remediation. With AI systems becoming prime targets for credential theft and resource hijacking, organizations must prioritize security updates and implement comprehensive monitoring across their AI workloads to prevent similar exploitation campaigns.
FalconFlank Zero-Day Targets CrowdStrike Falcon: When EDR Becomes the Attack Vector
In September 2026, security researcher Chaotic Eclipse released FalconFlank, a zero-day privilege escalation exploit targeting CrowdStrike Falcon endpoint security software. The vulnerability abuses office malicious macros remediation functionality within Falcon Sensor to achieve privilege escalation on fully updated Windows 11 25H2 and Windows Server 2025 systems. This disclosure follows the researcher's pattern of releasing proof-of-concept exploits for major endpoint security products, including recent vulnerabilities in Kaspersky and Microsoft Defender, highlighting systemic weaknesses in endpoint protection platforms. This incident underscores the growing trend of security researchers targeting endpoint detection and response (EDR) solutions themselves, exposing critical trust assumptions in enterprise security architectures and forcing organizations to reconsider their defense-in-depth strategies.
Serbian Student Activists Targeted by Pegasus Zero-Click Spyware Campaign
In December 2025 through January 2026, NSO Group's Pegasus spyware infected the iPhone of a Serbian student protest movement member using a zero-click iMessage exploit. The attack was part of a broader surveillance campaign targeting at least 14 Serbian activists, opposition politicians, and student leaders coinciding with March 2026 local elections. Citizen Lab and SHARE Foundation confirmed the infection, while a separate incident involved NoviSpy Android malware deployed during police detention of another student activist. This incident highlights the escalating use of commercial spyware against civil society, particularly as authoritarian governments increasingly weaponize surveillance technology to suppress political dissent and monitor opposition movements ahead of critical elections.
Shai-Hulud Infostealer Evolves to Target 469 Credential Locations Across Software Supply Chains
In August 2026, GitGuardian researchers discovered that the Shai-Hulud infostealer worm had evolved to scan for credentials across 469 locations in developer environments, representing a 148% increase from earlier variants that checked only 189 paths. The malware targets CI/CD tooling, cloud configurations, AI tool configs, package registries, and development environments to harvest reusable credentials for supply chain attacks. The stolen credentials enable lateral movement across trusted software supply chains, turning credential theft into ongoing propagation vectors through package publishing systems. This incident highlights the critical shift in attack methodologies where threat actors no longer need to break trust relationships but instead exploit existing credential sprawl across modern development ecosystems. The exponential increase in targeted credential locations demonstrates the growing sophistication of supply chain attacks and the urgent need for comprehensive secrets management across DevOps pipelines.
Threat Actors Weaponize Trusted Node.js Runtime for Stealth Malware Delivery
Since February 2026, threat actors have been weaponizing the legitimate Node.js JavaScript runtime (node.exe) to deliver malicious payloads in targeted attacks against government departments, technology companies, and hotels. The Symantec Threat Hunter Team identified this technique as particularly effective because node.exe is a trusted binary that can execute arbitrary JavaScript code while evading traditional security detection mechanisms. Attackers leverage the runtime's legitimate presence in enterprise environments to establish persistence, execute malware, and maintain command and control communications without triggering security alerts. This campaign reflects the growing trend of living-off-the-land tactics where attackers abuse legitimate system tools rather than deploying custom malware, making detection significantly more challenging for traditional security solutions and highlighting the need for behavioral analysis and runtime protection.