Find what you’re looking for
Browse everything
6,903 results in Threat Reports
Russia Hacked Routers to Steal Microsoft Office Tokens
In April 2026, Russian state-sponsored hackers, identified as APT28 (also known as Fancy Bear or Forest Blizzard), exploited vulnerabilities in outdated MikroTik and TP-Link routers to hijack DNS settings. This allowed them to intercept Microsoft Office authentication tokens from users across more than 18,000 networks without deploying malware. The attackers targeted government agencies, law enforcement, and third-party email providers, compromising over 200 organizations and 5,000 consumer devices. ([cyberkendra.com](https://www.cyberkendra.com/2026/04/your-router-is-spying-on-you-and.html?utm_source=openai)) This incident underscores the critical need for organizations to secure network infrastructure, especially as remote work increases reliance on home and small office routers. Ensuring devices are updated and monitoring for unauthorized DNS changes are essential to prevent similar attacks.
AI-Driven Supply Chain Attack Compromises GitHub Repositories
In March 2026, a threat actor utilized AI-assisted automation to execute over 450 exploit attempts against open-source repositories on GitHub. The campaign, identified as 'prt-scan,' specifically targeted repositories misconfigured with the 'pull_request_target' workflow trigger. While less than 10% of these attempts were successful, the attacker managed to compromise at least two NPM packages, leading to the exposure of ephemeral GitHub credentials. This incident underscores the growing trend of AI-enhanced supply chain attacks, where adversaries leverage automation to scale their operations and exploit common misconfigurations. Organizations are urged to review and secure their CI/CD pipelines to mitigate such risks.
Fortinet's 2026 Unauthenticated API Access Bypass: A Critical Security Alert
In April 2026, Fortinet disclosed a critical vulnerability (CVE-2026-35616) in its FortiClient Endpoint Management Server (EMS) versions 7.4.5 and 7.4.6. This improper access control flaw allowed unauthenticated attackers to execute unauthorized code or commands via crafted API requests. The vulnerability was actively exploited in the wild, prompting Fortinet to release emergency hotfixes and advise customers to apply them immediately. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/04/04/forticlient-ems-zero-day-cve-2026-35616/?utm_source=openai)) The incident underscores the persistent targeting of Fortinet products by threat actors, highlighting the importance of timely patch management and vigilant monitoring of security advisories to mitigate risks associated with zero-day vulnerabilities. ([tenable.com](https://www.tenable.com/blog/cve-2026-35616-fortinet-forticlientems-improper-access-control-vulnerability-exploited-in-the?utm_source=openai))
UNC1069's Social Engineering Compromise of Axios: A 2026 Supply Chain Attack
In late March 2026, the popular JavaScript HTTP client library Axios, with over 100 million weekly downloads, was compromised through a sophisticated social engineering attack. The North Korean state-sponsored group UNC1069 targeted lead maintainer Jason Saayman, gaining access to his npm account. The attackers published two malicious versions of Axios (1.14.1 and 0.30.4) that included a trojanized dependency, 'plain-crypto-js@4.2.1', which executed a post-install script to deploy a cross-platform Remote Access Trojan (RAT) upon installation. The malicious packages were available for approximately two to three hours before being removed, but the potential impact was significant due to Axios's widespread use. This incident underscores the increasing industrialization of social engineering attacks targeting open-source maintainers, highlighting the need for enhanced security measures within the software supply chain. The rapid detection and removal of the compromised packages prevented a more extensive breach, but the event serves as a critical reminder of the vulnerabilities inherent in widely used open-source projects.
Forest Blizzard's 2026 SOHO Router DNS Hijacking: A Wake-Up Call for Network Security
In April 2026, the Russian state-sponsored group Forest Blizzard exploited vulnerabilities in small office/home office (SOHO) routers to perform DNS hijacking and adversary-in-the-middle (AiTM) attacks. By compromising these routers, they redirected DNS requests through attacker-controlled servers, enabling interception of sensitive communications. This campaign affected over 200 organizations and 5,000 consumer devices, primarily targeting sectors such as government, IT, telecommunications, and energy. The attackers leveraged the compromised infrastructure to collect intelligence and potentially facilitate further malicious activities. This incident underscores the critical need for securing SOHO devices, as they can serve as entry points for sophisticated cyberattacks. Organizations must prioritize regular firmware updates, enforce strong authentication measures, and monitor network traffic for anomalies to mitigate such threats.
Storm-1175's Rapid Exploitation of Web Vulnerabilities in 2026
In early 2026, the financially motivated cybercriminal group Storm-1175 executed high-velocity ransomware campaigns by exploiting recently disclosed vulnerabilities in web-facing systems. The group rapidly transitioned from initial access to data exfiltration and deployment of Medusa ransomware, often within 24 hours. These attacks significantly impacted healthcare, education, professional services, and finance sectors across Australia, the United Kingdom, and the United States. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/04/06/storm-1175-focuses-gaze-on-vulnerable-web-facing-assets-in-high-tempo-medusa-ransomware-operations/?utm_source=openai)) This incident underscores the critical need for organizations to promptly apply security patches and enhance monitoring of web-facing assets. The rapid exploitation of vulnerabilities by threat actors like Storm-1175 highlights the importance of proactive defense measures to mitigate the risk of ransomware attacks.
Fortinet FortiClientEMS 2026 Improper Access Control Vulnerability
In April 2026, Fortinet disclosed a critical improper access control vulnerability (CVE-2026-35616) in FortiClient Endpoint Management Server (EMS) versions 7.4.5 and 7.4.6. This flaw allows unauthenticated attackers to execute unauthorized code or commands via crafted requests, leading to potential remote code execution and privilege escalation. The vulnerability has been actively exploited in the wild, prompting Fortinet to release emergency hotfixes and advise immediate patching to mitigate the risk. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/04/04/forticlient-ems-zero-day-cve-2026-35616/?utm_source=openai)) The exploitation of CVE-2026-35616 underscores the persistent targeting of Fortinet products by threat actors. Organizations are urged to apply the provided hotfixes promptly and monitor their systems for any signs of compromise to maintain robust security postures. ([tenable.com](https://www.tenable.com/blog/cve-2026-35616-fortinet-forticlientems-improper-access-control-vulnerability-exploited-in-the?utm_source=openai))
Fortinet's FortiClient EMS Zero-Day Vulnerability Exploited in 2026
In early April 2026, Fortinet disclosed a critical zero-day vulnerability (CVE-2026-35616) in its FortiClient Endpoint Management Server (EMS), which was actively exploited in the wild. This improper access control flaw allowed unauthenticated attackers to execute unauthorized code or commands via crafted requests. Fortinet released an emergency hotfix for versions 7.4.5 and 7.4.6, with plans for a comprehensive patch in version 7.4.7. The vulnerability was added to CISA's known exploited vulnerability catalog, highlighting its severity and widespread impact. The rapid exploitation of CVE-2026-35616 underscores a growing trend of attackers targeting zero-day vulnerabilities in widely used security solutions. Organizations must remain vigilant, ensuring timely application of patches and hotfixes to mitigate such threats. This incident also emphasizes the importance of robust access controls and continuous monitoring to detect and respond to unauthorized activities promptly.
GrafanaGhost: Unveiling the Critical AI Prompt Injection Vulnerability in Grafana
In April 2026, security researchers at Noma Security disclosed a critical vulnerability in Grafana, termed 'GrafanaGhost.' This exploit enables attackers to silently exfiltrate sensitive data by circumventing Grafana's AI defenses through prompt injection techniques. The attack does not require user interaction or authentication; it leverages crafted URLs to inject hidden instructions that Grafana's AI processes, leading to unauthorized data transmission to attacker-controlled servers. The vulnerability affects Grafana instances widely used for monitoring real-time financial metrics, infrastructure health data, and customer records, posing significant risks to enterprise data security. This incident underscores the escalating threat of AI prompt injection attacks, where adversaries manipulate AI systems to perform unintended actions. As AI integration in enterprise environments grows, such vulnerabilities highlight the urgent need for robust AI-specific security measures to prevent data breaches and maintain system integrity.
pcTattletale's 2024 Data Breach: A Cautionary Tale in Cybersecurity
In May 2024, pcTattletale, a U.S.-based spyware application, suffered a significant data breach when a hacker infiltrated its servers, defaced its website, and exposed sensitive data, including customer information and victim data. The breach was facilitated by exploiting vulnerabilities that allowed unauthorized access to the company's Amazon Web Services account, leading to the exposure of over 300 million screenshots captured from victims' devices. Following the incident, pcTattletale's founder, Bryan Fleming, announced the company's immediate shutdown, stating that all data had been deleted to prevent further exposure. This breach underscores the inherent risks associated with spyware applications, particularly their potential to compromise user privacy and security. The incident also highlights the growing scrutiny and legal actions against developers and distributors of such software, emphasizing the need for robust security measures and ethical considerations in software development.
Fortinet EMS Vulnerability CVE-2026-35616: Immediate Action Required
In April 2026, a critical vulnerability (CVE-2026-35616) was discovered in Fortinet's FortiClient Enterprise Management Server (EMS). This flaw allowed unauthenticated attackers to bypass authentication controls and execute arbitrary code via specially crafted requests. Fortinet released emergency hotfixes to address the issue, urging immediate application to prevent exploitation. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) mandated federal agencies to patch affected systems by April 9, 2026, highlighting the significant risk posed by this vulnerability. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-fortinet-flaw-exploited-in-attacks-by-friday/?utm_source=openai)) The exploitation of CVE-2026-35616 underscores the persistent threat of zero-day vulnerabilities in widely used enterprise solutions. Organizations are reminded of the critical importance of timely patch management and proactive security measures to mitigate such risks.
Drift Protocol's $280M Loss: A Case Study in Advanced Social Engineering
In April 2026, Drift Protocol, a decentralized finance platform on the Solana blockchain, suffered a sophisticated cyberattack resulting in the theft of approximately $280 million in digital assets. The attackers, identified as the North Korean state-sponsored group UNC4736, infiltrated the organization over a six-month period by posing as a legitimate quantitative trading firm. They engaged with Drift contributors at multiple industry conferences, building trust through in-person meetings and continued communication via Telegram. This prolonged social engineering campaign allowed them to gain unauthorized access to Drift's Security Council administrative powers, leading to the rapid exfiltration of funds. This incident underscores the evolving tactics of state-sponsored cyber actors, who are increasingly leveraging extended social engineering strategies to compromise high-value targets. The attack highlights the critical need for organizations to implement robust security protocols, including stringent verification processes and continuous monitoring, to defend against such sophisticated infiltration methods.