Find what you’re looking for
Browse everything
6,838 results in Threat Reports
Fake Claude & ChatGPT Campaigns Are Targeting Your Developers Right Now
Between April and October 2026, threat actors launched over 1,258 documented campaigns impersonating popular AI brands including Anthropic's Claude and OpenAI's ChatGPT to target enterprise developers and marketing professionals. Attackers leveraged SEO poisoning, malicious ads, fake GitHub-hosted CLI installers, and ClickFix-style social engineering to trick employees into running malicious terminal commands or pasting payloads into their systems. Successful compromises resulted in the theft of source code, SSH keys, CI/CD tokens, cloud API credentials, and active business session cookies—turning a single user action into broad organizational exposure including financial loss and supply chain risk. These campaigns reflect a rapidly maturing social engineering playbook that weaponizes the AI adoption wave. As enterprises push employees to integrate AI tooling into daily workflows, attackers exploit the resulting trust and urgency. The combination of legitimate hosting infrastructure (Claude.ai, ChatGPT domains, Cloudflare Pages, GitHub) with ClickFix and InstallFix tactics makes detection extremely difficult and signals a durable, escalating threat to developer-heavy organizations.
BYOVD and EDR Killers: Four Kill-Chain Variants, Four Hunts—Before Ransomware Encrypts Your Files
Bring Your Own Vulnerable Driver (BYOVD) attacks have become a cornerstone technique enabling ransomware groups such as RansomHub, Black Basta, Kasseika, BlackByte, and LockBit to neutralize endpoint detection and response (EDR) tools before deploying encryption. Attackers load legitimately signed but flawed kernel drivers—exploiting the gap between Microsoft's driver-signing trust model and its incomplete blocklist enforcement—to issue process-termination IOCTLs that kill security agents at Ring 0, bypassing Protected Process Light entirely. The commoditization of purpose-built EDR killers like AvNeutralizer (AuKill) and EDRKillShifter, sold on Russian-language forums for $4,000–$15,000 and distributed through ransomware affiliate programs, has industrialized what was once a sophisticated capability into a repeatable checklist item available to any affiliate operator. The BYOVD threat is no longer a niche kernel-exploitation concern—it is the standard pre-ransomware preparation step across multiple major threat actor ecosystems. With tooling commoditized, affiliate programs distributing EDR killers at scale, and four distinct kill-chain variants (BYOVD, BYOI, admin-to-kernel, and driverless suspension) each evading single-technique detection rules, organizations that rely on endpoint security alone face a widening, often invisible coverage gap that precedes every encryption event.
Major Cybersecurity Incidents Rock Week 40: Pentagon Breach, KillSec Takedown, and $387M Crypto Heist
Week 40 of 2026 witnessed three major cybersecurity incidents highlighting persistent threats across government, cryptocurrency, and organized cybercrime sectors. The Pentagon's Defense Manpower Data Center suffered a breach exposing personal data of 3 million military personnel and veterans, including Social Security numbers and military records, discovered in July 2026 but ongoing since October 2025. Simultaneously, North Korean state-sponsored hackers exploited third-party zero-day vulnerabilities to steal $387 million from Bitget cryptocurrency exchange, while international law enforcement successfully dismantled the KillSec ransomware operation, arresting key members including a 16-year-old administrator. These incidents demonstrate the convergence of nation-state attacks targeting critical infrastructure, the evolving sophistication of cryptocurrency heists, and the increasing involvement of younger cybercriminals in ransomware operations, underscoring the need for enhanced zero-trust security frameworks and international cybercrime cooperation.
CVE-2026-21589: Atlassian Data Center Under Siege as Exploits Hit Within Hours
Threat actors are actively exploiting CVE-2026-21589, a critical vulnerability in Atlassian Data Center products including Bitbucket, Confluence, and Jira, within two hours of public proof-of-concept release. The flaw allows unauthenticated attackers to access sensitive configuration files through path traversal sequences, potentially exposing administrative credentials and enabling privilege escalation. Multiple enterprises running unpatched Atlassian instances face immediate risk of unauthorized access and data compromise. This incident demonstrates the accelerating timeline between vulnerability disclosure and active exploitation, highlighting the critical importance of rapid patch deployment and network segmentation for enterprise applications exposed to the internet.
SneakPeek Vulnerability Exposes Critical AI Development Tool Security Gaps
In July 2026, security researchers at Noma disclosed a high-severity vulnerability dubbed 'SneakPeek' in Anthropic's Claude Code Desktop application. The zero-click vulnerability exploited flaws in the automated preview pane's sandbox architecture, allowing attackers to silently exfiltrate sensitive developer credentials including SSH private keys, AWS tokens, and OAuth credentials. By placing malicious HTML files larger than 256KB in public repositories, attackers could trigger automatic code execution when developers used Claude to review files, bypassing all sandbox protections through missing content security policies and unrestricted origin access. This incident highlights the growing security risks in AI-powered development tools as organizations increasingly integrate autonomous AI agents into critical workflows. The vulnerability required two separate patches after researchers bypassed the initial fix, demonstrating the complexity of securing AI applications and the need for comprehensive runtime protection beyond vendor-provided security baselines.
The Industrialization of BYOVD: How Ransomware Turned EDR Killing Into Big Business
Bring Your Own Vulnerable Driver (BYOVD) attacks have evolved from isolated tactics into an industrialized supply chain serving ransomware operators. Research shows attackers successfully disabled security tools in 48% of intrusions in 2024, with BYOVD emerging as the fastest-growing method. What began as custom one-off binaries has transformed into a mature marketplace, with tools like AvNeutralizer selling for $4,000-$15,000 and spreading across multiple ransomware families including Black Basta, LockBit, and RansomHub. The technique leverages thousands of vulnerable signed drivers to achieve kernel-level access and terminate EDR processes, with some attack chains reaching SYSTEM privileges in just 30 milliseconds. This industrialization has dramatically lowered the skill barrier for ransomware affiliates while increasing attack success rates. The threat landscape now features maintained toolkits, versioned releases, and tiered affiliate access models that mirror legitimate software development practices, making BYOVD a structural threat to enterprise security defenses.
The BYOVD Trust Gap: How Vulnerable Drivers Bypass Modern Security
Bring Your Own Vulnerable Driver (BYOVD) attacks exploit a fundamental trust gap in Windows kernel security, where attackers leverage legitimate but vulnerable signed drivers to bypass endpoint protection systems. Recent analysis shows approximately 36% of catalogued vulnerable drivers remain unblocked by default Windows security policies, with attackers exploiting revoked and expired certificates that the kernel still accepts. These attacks concentrate on compromised signing certificates rather than individual drivers, allowing threat actors to generate unlimited malicious payloads using stolen cryptographic keys. The persistence of this attack vector demonstrates a structural flaw in how operating systems validate driver trust, with some vulnerable drivers remaining exploitable for years after initial disclosure. This attack method has gained renewed prominence as ransomware groups and APT actors increasingly adopt BYOVD techniques to disable security tools and establish kernel-level persistence, highlighting the urgent need for trust-based rather than signature-based defensive approaches.
Yam Store Exposed: How Storm-3119 Built a Billion-Message Phishing Empire
In 2026, Microsoft Threat Intelligence exposed Yam Store, a Chinese-language cybercrime marketplace tracked as Storm-3119, responsible for facilitating over one billion phishing emails and SMS messages targeting 75,000 organizations worldwide. The operation sold phishing kits including CoGUI, Haozi, and Iron Man System, along with fraudulently obtained Microsoft and Google cloud domains from legitimate organizations. Storm-3119 leveraged automation to identify expired environments and used legitimate customer information to circumvent detection systems, enabling threat actors to operate seemingly trustworthy phishing infrastructure at scale. This incident highlights the industrialization of phishing-as-a-service operations and the increasing sophistication of cloud infrastructure abuse. As threat actors leverage AI and legitimate cloud services to enhance their campaigns, organizations face unprecedented challenges in distinguishing malicious activity from legitimate communications, making traditional security awareness training and detection methods insufficient.
UTA0576 Exploits Ivanti Connect Secure Zero-Day Despite Partial Vendor Discovery
In October 2026, threat actor UTA0576 exploited a zero-day vulnerability chain in Ivanti Connect Secure (ICS) appliances, tracked as CVE-2026-104935, combining authentication bypass and remote code execution flaws. The attack compromised fully patched ICS devices, allowing attackers to gain root-level access, extract credentials, and pivot into Active Directory environments. While Ivanti had partially discovered the vulnerability through AI-assisted security scanning in July 2026 and patched newer versions, the fix had not been backported to all supported versions when exploitation began on October 3, 2026. This incident highlights the growing sophistication of threat actors who monitor vendor patch releases to identify unpatched vulnerabilities across product versions. The attack demonstrates how the window between partial fixes and comprehensive deployment creates exploitable gaps, emphasizing the critical need for coordinated vulnerability management and rapid deployment capabilities in an era of accelerated threat actor reconnaissance.
European Grocery Chains Hit by Massive Refrigeration System Cyberattack
In October 2026, cybercriminals exploited unpatched vulnerabilities in Danfoss and XWEB refrigeration controllers across over 400 European grocery stores, converting refrigerators and freezers into heating units that reached 50°C (120°F). The attackers manipulated defrost cycles to mask the sabotage, causing complete spoilage of perishable inventory and estimated losses exceeding several million euros. The attacks leveraged CVE-2025-41450, CVE-2025-41451, and CVE-2025-41452 affecting end-of-life Danfoss AK-SM 800A platforms, along with 23 vulnerabilities in XWEB Pro systems disclosed by Claroty researchers in August 2026. This incident highlights the growing threat to operational technology (OT) environments where legacy industrial control systems remain Internet-exposed and unpatched. As critical infrastructure increasingly relies on connected IoT devices for remote monitoring and control, attackers are shifting focus from traditional IT networks to industrial systems that can cause immediate physical and financial damage.
Langflow's Critical RCE Flaw Under Active Attack: 1,423 Exploitation Attempts Detected
A critical authenticated remote code execution vulnerability (CVE-2026-105740, CVSS 9.9) in Langflow, an open-source AI application development platform owned by DataStax and acquired by IBM in February 2025, is being actively exploited by threat actors. The flaw allows any authenticated user to execute arbitrary OS commands through malicious MCP server configurations with zero validation. Previdian honeypot sensors recorded 1,423 exploitation attempts from 27 unique IP addresses across 15 countries since September 2026, with activity significantly ramping up in October. Attackers are using common credentials to authenticate and then exploiting the vulnerability to extract sensitive configurations, access host filesystems, and establish persistent backdoors. This incident highlights the growing threat landscape targeting AI development platforms as organizations rapidly adopt AI technologies without adequate security oversight. The systematic targeting of multiple Langflow vulnerabilities by the same threat actors demonstrates the critical need for securing AI infrastructure as these platforms become integral to business operations.
AhsayCBS Critical Flaws Enable Cryptojacking Through Incomplete Patches
In October 2026, threat actors exploited two critical vulnerabilities (CVE-2026-105133 and CVE-2026-105134) in Ahsay's AhsayCBS backup software to deploy web shells and XMRig cryptocurrency miners. The flaws allowed attackers to chain authentication bypass with remote code execution capabilities on exposed systems. Initial patches released in August 2026 were incomplete, prompting Ahsay to issue emergency hotfixes in versions 10.3.4.45 and 9.15.2.70. The active exploitation led CISA to add both vulnerabilities to the Known Exploited Vulnerabilities catalog with a mandatory October 17, 2026 remediation deadline for federal agencies. This incident highlights the growing trend of cryptojacking attacks targeting enterprise backup infrastructure and the challenges of incomplete vulnerability remediation in critical business systems.