Find what you’re looking for
Browse everything
6,909 results in Threat Reports
SoFi Hong Kong Data Breach: Lessons in Third-Party Risk Management
In April 2026, SoFi Hong Kong, a subsidiary of the U.S.-based financial technology company SoFi Technologies, detected unauthorized access to a customer database managed by a third-party vendor. The breach, discovered on April 30, 2026, prompted SoFi to engage a cybersecurity firm to investigate. While the full scope of the incident remains under investigation, the company has advised customers to monitor their accounts for suspicious activity and has implemented additional security measures to protect affected accounts. This incident underscores the critical importance of robust third-party risk management in the financial sector. As financial institutions increasingly rely on external vendors for data management, ensuring these partners adhere to stringent security protocols is essential to prevent unauthorized access and protect sensitive customer information.
Massive Exploitation of Ghost CMS Vulnerability CVE-2026-26980
In May 2026, a critical SQL injection vulnerability (CVE-2026-26980) in Ghost CMS was exploited to compromise over 700 websites, including those of Harvard University, Oxford University, and DuckDuckGo. Attackers injected malicious JavaScript into these sites, presenting visitors with fake Cloudflare verification prompts that, when followed, installed malware on their systems. This vulnerability, with a CVSS score of 9.4, allowed unauthenticated attackers to read arbitrary data from the database, leading to widespread data breaches and malware distribution. ([techtimes.com](https://www.techtimes.com/articles/317134/20260525/ghost-cms-sql-injection-hits-700-sites-harvard-duckduckgo-serve-fake-cloudflare-malware.htm?utm_source=openai)) The exploitation of this vulnerability underscores the critical importance of timely patch management. Despite a patch being available since February 2026, many organizations failed to apply it, resulting in significant security incidents. This case highlights the ongoing risks associated with unpatched software and the necessity for organizations to maintain robust vulnerability management practices. ([techradar.com](https://www.techradar.com/pro/security/ghost-cms-flaw-hijacked-to-target-hundreds-of-websites-with-clickfix-attacks-heres-how-to-stay-safe?utm_source=openai))
Security Incident Highlights Risks in Microsoft Entra Agent ID's Assistive Agents
In May 2026, a security incident involving Microsoft Entra Agent ID's assistive agents was identified. An AI agent, operating under the On-Behalf-Of (OBO) authentication flow, sent a suspicious email with the subject 'Here is your invoice' from matt@ContosoCorp.onmicrosoft.com to an external recipient. The email originated from IP address 51.3.97.221, utilizing the Microsoft Graph beta API. This activity raised concerns about potential misuse of delegated permissions granted to AI agents, highlighting vulnerabilities in the OBO flow that could be exploited for unauthorized actions. The incident underscores the growing security challenges associated with AI agents in enterprise environments. As organizations increasingly integrate AI-driven workflows, ensuring robust identity and access management for these agents becomes critical. This event serves as a reminder of the importance of monitoring AI agent activities and implementing stringent controls to prevent unauthorized access and actions.
Hades Campaign: A New Threat to PyPI Security
In June 2026, a sophisticated supply chain attack targeted the Python Package Index (PyPI), compromising 37 wheels across 19 packages. The attackers, adopting a 'Hades' naming convention, deployed a variant of the Shai-Hulud worm, which is known for its self-propagating and information-stealing capabilities. This malware infects software components, utilizes the access to publish malicious versions, and harvests repository accounts of downstream users. The attack chain's cross-runtime design involved the installation of Bun—a JavaScript runtime—as a heavily obfuscated JavaScript stealer before executing the payload. This incident underscores the persistent and evolving nature of software supply chain threats. The use of cross-runtime techniques and obfuscated payloads highlights the increasing sophistication of attackers, emphasizing the need for robust security measures in open-source ecosystems.
VerdantBamboo's Prolonged Cyber Espionage via BRICKSTORM Backdoor
In September 2025, cybersecurity firm Volexity identified a prolonged cyber espionage campaign by the Chinese state-sponsored group VerdantBamboo, also known as UNC5221. The attackers exploited a local privilege escalation vulnerability in an Egnyte Storage Sync appliance to deploy a BSD variant of the BRICKSTORM backdoor, maintaining undetected access for at least 18 months. This access facilitated further infiltration into the victim's Microsoft 365 environment and the deployment of additional malware, including PLENET and AGENTPSD, on various network appliances. The campaign underscores the increasing targeting of network appliances and storage systems by sophisticated threat actors, exploiting their lack of endpoint detection capabilities to establish long-term persistence. Organizations are urged to enhance monitoring and security measures for such devices to mitigate similar threats.
UNC3753's 2026 Data Theft Campaign: A Blend of Vishing and Physical Intrusions
Between January and May 2026, the threat actor UNC3753, also known as Chatty Spider, Luna Moth, and Silent Ransom Group (SRG), targeted numerous U.S. organizations in the professional, legal, and financial sectors. Utilizing voice phishing (vishing) and social engineering tactics, they impersonated IT support to gain remote access via screen-sharing sessions and remote monitoring tools. In some cases, attackers physically infiltrated offices, posing as IT technicians to exfiltrate data using USB devices. Stolen information included proprietary legal agreements, personally identifiable information (PII), and financial records. The group rapidly demanded ransoms, threatening to publish the stolen data if payments were not made promptly. This incident underscores the evolving tactics of cybercriminals, combining traditional social engineering with physical intrusion methods. The rapid execution of these attacks, often completed within a single business day, highlights the need for organizations to enhance their security awareness training and implement robust verification processes for IT support interactions.
Weekly Recap: Instagram Account Hacks, Android Zero-Day, GitHub Worm and More
In early June 2026, multiple significant cybersecurity incidents emerged, including the exploitation of Meta's AI-driven customer support system to hijack high-profile Instagram accounts, a critical zero-day vulnerability in Qualcomm chipsets affecting numerous Android devices, and a self-replicating worm targeting Microsoft's GitHub repositories. These events underscore the persistent and evolving nature of cyber threats, highlighting vulnerabilities in widely used platforms and the need for robust security measures. The exploitation of AI systems for unauthorized access, the discovery of critical hardware vulnerabilities, and the targeting of major code repositories reflect a broader trend of increasingly sophisticated cyberattacks. Organizations must remain vigilant, continuously update their security protocols, and invest in advanced threat detection to mitigate these evolving risks.
Red Hat npm Packages Compromised in June 2026 Supply Chain Attack
In June 2026, a sophisticated supply chain attack was identified, involving the compromise of Red Hat's npm packages. Attackers infiltrated a Red Hat employee's GitHub account, injecting malware into numerous npm packages under the Red Hat Cloud Services namespace. This breach led to over 80,000 downloads of compromised packages within a week, targeting sensitive data such as GitHub Actions secrets, npm tokens, SSH keys, and cloud credentials. The malicious code employed encrypted exfiltration techniques, posing significant risks to developers and organizations relying on these packages. This incident underscores the escalating threat of supply chain attacks, particularly those exploiting open-source ecosystems. The attackers' use of advanced techniques, including encrypted exfiltration and targeting cloud identities, highlights the need for enhanced vigilance and robust security measures in software development and distribution processes.
Critical Check Point VPN Flaw Exploited: CVE-2026-50751
In early June 2026, Check Point Software Technologies disclosed active exploitation of a critical vulnerability, CVE-2026-50751, affecting their Remote Access VPN and Mobile Access products configured with the deprecated IKEv1 key exchange protocol. This flaw allows unauthenticated remote attackers to bypass user authentication and establish unauthorized VPN connections. Exploitation has been observed since at least May 7, 2026, with increased activity in early June, including incidents linked to a Qilin ransomware affiliate. ([blog.checkpoint.com](https://blog.checkpoint.com/security/check-point-releases-important-hotfix-for-vulnerabilities-in-deprecated-ikev1-vpn-protocol/amp/?utm_source=openai)) The incident underscores the risks associated with using outdated protocols like IKEv1, which, despite being deprecated, remain in use for legacy compatibility. Organizations are urged to disable IKEv1 and apply security updates to mitigate this vulnerability. ([blog.checkpoint.com](https://blog.checkpoint.com/security/check-point-releases-important-hotfix-for-vulnerabilities-in-deprecated-ikev1-vpn-protocol/amp/?utm_source=openai))
AI-Generated Phishing Attacks Overwhelm SOCs in 2026
In early 2026, organizations experienced a surge in AI-generated phishing attacks, leading to an overwhelming increase in security alerts. These sophisticated campaigns utilized generative AI to craft convincing emails and evade traditional detection methods, significantly burdening Security Operations Centers (SOCs). As a result, SOCs faced challenges in effectively triaging and responding to the high volume of alerts, with only 37% of daily security alerts being investigated. This escalation in alert volume not only strained resources but also increased the risk of overlooking genuine threats, thereby elevating the overall cost and complexity of cybersecurity operations. ([prnewswire.com](https://www.prnewswire.com/news-releases/new-research-reveals-enterprises-investigate-just-37-of-daily-security-alerts-as-ai-expands-in-the-soc-302717184.html?utm_source=openai)) The proliferation of AI-driven phishing attacks underscores the urgent need for organizations to adapt their cybersecurity strategies. Traditional defense mechanisms are proving inadequate against the scale and sophistication of these threats. Implementing advanced AI-powered defenses and enhancing SOC capabilities are critical to effectively manage and mitigate the risks associated with AI-generated phishing campaigns.
C0XMO Botnet's 2026 Exploitation of DD-WRT Router Vulnerability
In June 2026, the C0XMO botnet, a sophisticated variant of the Gafgyt malware, exploited a buffer overflow vulnerability (CVE-2021-27137) in DD-WRT router firmware to compromise devices across multiple CPU architectures, including ARM, MIPS, and x86. The botnet's modular design enabled it to launch distributed denial-of-service (DDoS) attacks using 19 different methods and to eliminate competing malware by terminating their processes and removing persistence mechanisms. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/c0xmo-botnet-spreads-via-dd-wrt-router-flaw-kills-rival-malware/?utm_source=openai)) This incident underscores the escalating threat posed by advanced IoT botnets that leverage unpatched vulnerabilities in widely used devices. Organizations must prioritize timely firmware updates, enforce strong authentication practices, and disable unnecessary remote access to mitigate such risks.
Silent Ransom Group Exploits Law Firms with Sophisticated Social Engineering Attacks
In early 2026, the Silent Ransom Group (SRG), also known as Luna Moth and Chatty Spider, targeted U.S. law firms and professional services organizations through sophisticated social engineering attacks. The group initiated contact via invoice-themed phishing emails, followed by phone calls impersonating corporate IT staff. They convinced employees to join remote support sessions, leading to the installation of remote monitoring tools like AnyDesk and Zoho Assist, granting attackers access to sensitive legal and financial documents. Data exfiltration was conducted using tools such as WinSCP and Rclone, with ransom demands issued within 30 minutes of the attackers' departure. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/silent-ransom-group-targets-law-firms-with-fake-it-support-calls/?utm_source=openai)) This incident underscores a concerning trend of cybercriminals employing direct social engineering tactics, including in-person impersonation, to infiltrate organizations. The rapid escalation from initial contact to data theft and extortion highlights the need for enhanced employee training and robust verification procedures to counter such evolving threats. ([techcrunch.com](https://techcrunch.com/2026/06/05/google-and-fbi-warn-of-ransomware-group-that-sends-fake-it-workers-to-hack-victims-in-person/?utm_source=openai))