Find what you’re looking for
Browse everything
6,892 results in Threat Reports
AkzoNobel's 2026 Encounter with Anubis Ransomware: A Case Study
In early March 2026, AkzoNobel, a leading multinational paint and coatings company, experienced a cyberattack at one of its U.S. sites. The Anubis ransomware group claimed responsibility, asserting they had exfiltrated 170GB of sensitive data, including confidential client agreements, personal employee information, and internal technical documents. AkzoNobel confirmed the breach, stating it was contained to the specific site and that the impact was limited. The company is collaborating with relevant authorities and has initiated notifications to affected parties. This incident underscores the evolving tactics of ransomware groups like Anubis, which have expanded their operations to include data exfiltration and destruction, increasing pressure on victims. Organizations must remain vigilant, as such attacks highlight the critical need for robust cybersecurity measures and incident response plans to mitigate potential damages.
Starkiller Phishing Kit: A New Era of MFA Bypass Attacks
In early 2026, cybersecurity researchers uncovered 'Starkiller,' a sophisticated phishing-as-a-service (PhaaS) platform developed by the cybercrime group Jinkusu. Unlike traditional phishing kits that rely on static HTML clones, Starkiller employs a headless Chrome browser within a Docker container to proxy legitimate login pages in real-time. This adversary-in-the-middle (AiTM) approach allows attackers to intercept user credentials and session tokens, effectively bypassing multi-factor authentication (MFA) mechanisms. The platform's user-friendly control panel enables even low-skilled cybercriminals to launch advanced phishing campaigns, posing a significant threat to organizations relying solely on conventional MFA for security. ([abnormal.ai](https://abnormal.ai/blog/starkiller-phishing-kit?utm_source=openai)) The emergence of Starkiller underscores a critical shift in the cyber threat landscape, highlighting the limitations of traditional MFA solutions against evolving phishing techniques. Organizations must adopt phishing-resistant authentication methods, such as FIDO2/WebAuthn-based hardware security keys, and implement continuous monitoring for anomalous session behaviors to mitigate the risks posed by such advanced phishing platforms. ([bytearchitect.io](https://bytearchitect.io/network-security/Starkiller-Phishing-Kit-Why-MFA-Fails-Against-Real-Time-Reverse-Proxies/?utm_source=openai))
Microsoft Warns of OAuth Redirect Abuse Delivering Malware to Government Targets
In March 2026, Microsoft identified phishing campaigns exploiting OAuth's standard redirection mechanisms to deliver malware to government and public-sector organizations. Attackers created malicious applications with redirect URLs pointing to rogue domains hosting malware. They distributed OAuth phishing links prompting recipients to authenticate via these applications using intentionally invalid scopes. This process redirected users to attacker-controlled pages, leading to inadvertent malware downloads. The payloads, often in ZIP archives, executed PowerShell commands upon opening, resulting in host reconnaissance, DLL side-loading, and connections to external command-and-control servers. Phishing emails employed lures such as e-signature requests, Teams recordings, and financial themes, sent through mass-sending tools and custom solutions developed in Python and Node.js. Microsoft has since removed several malicious OAuth applications and advises organizations to limit user consent, periodically review application permissions, and remove unused or overprivileged apps. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/03/02/oauth-redirection-abuse-enables-phishing-malware-delivery/?utm_source=openai))
AI-Assisted FortiGate Breach 2026: A Wake-Up Call for Network Security
Between January 11 and February 18, 2026, a Russian-speaking, financially motivated threat actor utilized multiple commercial generative AI services to compromise over 600 Fortinet FortiGate firewalls across more than 55 countries. The attacker exploited exposed management interfaces and weak credentials lacking multi-factor authentication, without leveraging any known FortiGate vulnerabilities. This campaign underscores the growing trend of cybercriminals employing AI tools to automate and scale attacks, significantly reducing the technical expertise required to execute large-scale intrusions. The incident highlights the urgent need for organizations to secure management interfaces, enforce strong authentication mechanisms, and stay vigilant against AI-assisted cyber threats.
Cybercriminals Exploit Fake Tech Support to Deploy Havoc C2 Framework
In February 2026, a sophisticated cyberattack campaign was identified targeting multiple organizations. Threat actors impersonated IT support personnel, initiating contact through spam emails followed by phone calls. They convinced victims to grant remote access via tools like AnyDesk, leading to the deployment of a customized version of the Havoc command-and-control (C2) framework. This allowed rapid lateral movement within networks, with the attackers compromising multiple endpoints within hours, indicating objectives of data exfiltration or ransomware deployment. This incident underscores the evolving tactics of cybercriminals, combining social engineering with advanced malware to infiltrate organizations. The use of open-source C2 frameworks like Havoc, customized to evade detection, highlights the need for enhanced vigilance and updated security protocols to counter such multifaceted threats.
Project Compass: Unveiling the Arrests in 'The Com' Cybercrime Network
In January 2025, Europol initiated Project Compass, a coordinated international operation targeting 'The Com,' a decentralized cybercriminal collective known for engaging in ransomware attacks, financial extortion, and the exploitation of minors. Over the course of the year, the operation led to the arrest of 30 individuals and the identification of 179 additional suspects across 28 countries. Investigators also identified 62 victims, with four being directly safeguarded from further harm. 'The Com' primarily consists of English-speaking individuals aged 16 to 25, who utilize social media platforms, messaging applications, and online gaming environments to recruit and exploit young people. The group's decentralized structure and use of various online platforms have made it particularly challenging for law enforcement to disrupt their activities. The success of Project Compass underscores the importance of international collaboration in combating cybercrime and highlights the ongoing threat posed by such decentralized networks. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/02/27/europol-the-com-network-arrests/?utm_source=openai)) The significance of this operation is underscored by the increasing prevalence of cybercriminal groups targeting vulnerable populations through online platforms. The arrest of key members of 'The Com' serves as a critical reminder of the need for continuous vigilance and proactive measures to protect minors from online exploitation. Additionally, the operation highlights the evolving tactics of cybercriminals, who are increasingly leveraging decentralized networks and social engineering techniques to perpetrate their crimes. ([darkreading.com](https://www.darkreading.com/threat-intelligence/30-alleged-members-the-com-arrested-project-compass/?utm_source=openai))
OpenClaw Vulnerability Highlights AI Agent Security Risks
In February 2026, a critical vulnerability (CVE-2026-25253) was discovered in OpenClaw, an open-source AI agent platform, allowing attackers to execute arbitrary code on users' systems via malicious web pages. This flaw exposed over 42,000 instances globally, leading to unauthorized access, data exfiltration, and potential system compromise. The vulnerability was promptly patched in version 2026.1.29, but the incident highlighted significant security concerns inherent in AI agent architectures. ([taoapex.com](https://taoapex.com/en/guides/deploy-personal-ai-assistant-openclaw/?utm_source=openai)) The rapid adoption of AI agents like OpenClaw has outpaced the development of robust security measures, making them attractive targets for cybercriminals. This incident underscores the urgent need for comprehensive security frameworks and best practices to mitigate risks associated with autonomous AI systems.
Pro-Iranian Cyberattacks 2026: Unveiling the Threat to Critical Infrastructure
In early 2026, amid escalating geopolitical tensions, pro-Iranian cyber actors launched a series of coordinated cyberattacks targeting critical infrastructure in the United States and allied nations. These attacks aimed to disrupt essential services, including utilities and transportation systems, and were characterized by sophisticated techniques such as ransomware deployment and data exfiltration. The cyber offensive resulted in significant operational disruptions and financial losses, highlighting the evolving threat landscape posed by nation-state-sponsored cyber activities. This incident underscores the persistent and adaptive nature of cyber threats from nation-state actors, particularly in the context of geopolitical conflicts. Organizations are urged to enhance their cybersecurity posture by implementing robust defense mechanisms, conducting regular threat assessments, and fostering information-sharing partnerships to mitigate the risks associated with such sophisticated cyberattacks.
Understanding OAuth Redirection Abuse in Phishing Attacks
In March 2026, Microsoft identified a sophisticated phishing campaign exploiting OAuth's redirection mechanisms to deliver malware. Attackers crafted URLs using legitimate identity providers like Microsoft Entra ID and Google Workspace, embedding them in phishing emails with themes such as e-signature requests and financial documents. When recipients clicked these links, they were redirected through trusted domains to attacker-controlled sites, leading to malware downloads. This method effectively bypassed traditional email and browser security defenses, resulting in significant compromises across government and public-sector organizations. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/03/02/oauth-redirection-abuse-enables-phishing-malware-delivery/?utm_source=openai)) This incident underscores a growing trend where threat actors leverage legitimate protocol features to conduct malicious activities. The abuse of OAuth redirection highlights the need for organizations to enhance monitoring of authentication flows and implement stricter controls over third-party application permissions to mitigate such evolving threats.
IBM Bob's 2026 Prompt Injection Vulnerability Exposes AI Security Risks
In January 2026, security researchers at Prompt Armor identified a critical vulnerability in IBM's generative AI tool, Bob, which was in its beta phase. The flaw allowed for indirect prompt injection attacks, enabling malicious actors to embed hidden commands within emails or calendar entries. When Bob processed these inputs, it could be manipulated to perform unauthorized actions such as data exfiltration, malware execution, or establishing persistent system access. This vulnerability was particularly concerning due to Bob's integration capabilities with other applications, amplifying the potential attack surface. The incident underscores the inherent risks associated with AI systems that process untrusted data sources. As AI tools become more integrated into business workflows, the potential for such vulnerabilities increases, highlighting the need for robust security measures. Organizations must prioritize the development and implementation of safeguards to prevent prompt injection attacks and ensure the secure deployment of AI technologies.
CrushFTP 2025 Brute-Force Attack Highlights Credential Vulnerabilities
In March 2025, CrushFTP servers were targeted by brute-force attacks exploiting default or weak credentials, particularly the 'crushadmin' account with the password 'crushadmin'. These attacks originated from IP address 5.189.139.225, a French IP with a history of exploit attempts targeting simple vulnerabilities. The attackers aimed to gain unauthorized administrative access, potentially leading to data exfiltration and system compromise. This incident underscores the critical importance of enforcing strong password policies and regularly updating default credentials to prevent unauthorized access. Organizations are advised to review their authentication mechanisms and implement multi-factor authentication where possible to mitigate such risks.
March 2026 Iranian Cyberattacks: A Wake-Up Call for Critical Infrastructure Security
In early March 2026, Iranian state-sponsored cyber actors launched a series of coordinated cyberattacks targeting critical infrastructure and government entities across the United States and its allies. These attacks included sophisticated phishing campaigns, deployment of data-exfiltrating malware, and disruptive operations attributed to Iranian-aligned hacktivist groups. The cyber offensive coincided with heightened geopolitical tensions following military strikes in the region, leading to significant disruptions in services and raising concerns over national security vulnerabilities. The escalation underscores the persistent threat posed by nation-state actors leveraging cyber capabilities to achieve strategic objectives. Organizations are urged to enhance their cybersecurity posture, as the current geopolitical climate suggests a continued risk of similar cyber operations targeting critical infrastructure and sensitive data.