Find what you’re looking for
Browse everything
6,877 results in Threat Reports
Okta SSO Targeted: 2024 Vishing Surge Exposes Credential Gaps
In early 2024, Okta Single Sign-On (SSO) user accounts became the target of sophisticated phishing campaigns leveraging custom voice-based social engineering (vishing) kits. Threat actors contacted employees via phone calls, impersonating IT staff and using convincing pretexts to direct users to phishing sites tailored to mimic Okta’s authentication workflow. By capturing the credentials and multi-factor authentication (MFA) tokens, attackers accessed sensitive enterprise environments, leading to data exfiltration, disruption of operations, and potential exposure of downstream customers relying on Okta SSO for access control. This incident highlights a broader escalation in the use of vishing tactics to bypass strong authentication, underscoring the ongoing shift toward highly targeted, voice-enabled phishing attacks. Enterprises must adapt security and training programs to confront increasingly sophisticated social engineering methods targeting identity infrastructures.
INC Ransomware OpSec Fail Uncovers Data from 12 U.S. Organizations
In January 2026, an operational security lapse in the INC ransomware group's infrastructure enabled Cyber Centaurs researchers to recover encrypted data exfiltrated from twelve U.S. organizations. The investigation began after a RainINC ransomware attack on a client’s production SQL Server. Forensic analysis traced renamed binaries, PowerShell scripts, and usage of the Restic backup tool, revealing attacker scripts with hardcoded credentials and references to persistent cloud storage. By enumerating the attacker-controlled repositories, researchers identified encrypted data from healthcare, manufacturing, technology, and services firms, then decrypted and preserved it in coordination with law enforcement. This case highlights a rare opportunity where attacker mistakes allowed post-breach data retrieval for unrelated victim organizations. The incident underscores a growing trend in ransomware operations leveraging legitimate backup and exfiltration tools, persistent attacker infrastructure, and the importance of thorough incident response for uncovering wider impacts.
SmarterMail Auth Bypass Allows Attackers to Reset Admin Accounts in Live Exploits
In January 2026, attackers began exploiting an authentication bypass vulnerability in SmarterTools’ SmarterMail email server platform, which enabled unauthenticated users to reset admin account passwords and seize full system control. The flaw, residing in a publicly-exposed API endpoint allowing forced resets with attacker-supplied JSON, let threat actors escalate privileges by resetting admin credentials, paving the way to remote code execution. The vulnerability was disclosed in early January, patched on January 15, and observed in active exploitation just days later as attackers reverse-engineered the fix to target unpatched servers globally. This incident draws attention to the criticality of prompt patch management and highlights the ongoing risk of API flaws being rapidly weaponized post-disclosure. It underscores a broader trend of attackers targeting authentication controls in business-critical SaaS and infrastructure applications, raising regulatory and operational pressure for stronger access security and rapid response procedures.
GitLab Faces Critical 2FA Bypass and DoS Vulnerabilities in 2026
In January 2026, GitLab urgently patched several high-severity vulnerabilities affecting its widely used Community and Enterprise Editions. The most critical issue, tracked as CVE-2026-0723, allowed attackers with knowledge of a user's account ID to bypass two-factor authentication controls by submitting forged device responses, resulting from unchecked return values in authentication services. In addition, GitLab addressed multiple denial-of-service (DoS) vulnerabilities, including CVE-2025-13927 and CVE-2025-13928, which potentially let unauthenticated threat actors trigger service outages through malformed authentication data and improper API endpoint authorization checks. Immediate patches were released to mitigate the risks of account takeover, service disruption, and operational downtime across a user base spanning major enterprises and nearly 6,000 exposed internet-facing instances. This breach stands out in the context of rising attacks exploiting authentication weaknesses and API logic flaws across the software supply chain. As critical open-source DevSecOps platforms like GitLab underpin enterprise workflows, attackers increasingly target authentication and availability gaps, aligning with regulatory scrutiny and the growing demand for robust zero trust controls.
Tesla and Leading Automakers Hacked at Pwn2Own Automotive 2026: 37 Zero-Days Uncovered
In January 2026, security researchers at the Pwn2Own Automotive competition in Tokyo successfully exploited 37 zero-day vulnerabilities across flagship automotive technologies, including Tesla's infotainment system, multiple EV chargers, and in-vehicle digital receivers. The Synacktiv team achieved root access on the Tesla Infotainment System through chained vulnerabilities involving an information leak and out-of-bounds write flaw via USB. Other researchers compromised systems from Sony, Alpitronic, Autel, Kenwood, and Phoenix Contact. The event demonstrates the breadth of exploitable attack surfaces even in patched, production automotive hardware and highlights coordinated vulnerability disclosure processes wherein vendors have 90 days to issue fixes. This incident underscores how automotive technology—including electric vehicles and charging infrastructure—remains a top target for advanced security researchers, with new zero-day vulnerabilities continually emerging. As vehicle software stacks grow in complexity and interconnectivity, the imperative for proactive, industry-wide security controls and coordinated patch processes is increasingly urgent.
Exposed Security Testing Apps Used to Breach Fortune 500 Cloud Environments (2026)
In January 2026, threat actors exploited misconfigured web applications used for security testing and internal penetration testing—such as DVWA, OWASP Juice Shop, Hackazon, and bWAPP—publicly exposed by Fortune 500 companies and major security vendors. By targeting these intentionally vulnerable apps tied to overly privileged cloud accounts in AWS, GCP, and Azure, attackers gained unauthorized access, deployed Monero (XMR) crypto miners, planted persistent webshells, and pivoted to sensitive cloud assets. Over 1,900 instances were found online, many with default credentials and excessive permissions, exposing secrets and allowing full access to cloud resources including storage buckets and Secrets Manager. Victim organizations remediated after being notified. This incident highlights a growing attack pattern where "friendly" security test and training tools become high-risk assets when mismanaged in cloud environments. Their exploitation underscores pressing gaps in cloud inventory management, IAM least-privilege enforcement, and secret sprawl, at a time of escalating attacks exploiting cloud misconfiguration and supply chain weaknesses.
Why Even Security Pros Get Phished: The Human & AI-Powered Phishing Crisis of 2026
In January 2026, multiple incidents highlighted how even vigilant individuals and cybersecurity professionals are susceptible to highly convincing phishing attacks. Attackers leveraged advanced social engineering techniques and sophisticated phishing-as-a-service (PhaaS) platforms, often enhanced by AI-driven content generators such as PhishGPT, to deliver targeted messages via email, SMS, and collaboration tools. These lures bypassed traditional defenses, exploiting moments of distraction or emotional vulnerability to harvest sensitive information including credentials and payment data. The operational impact ranged from financial loss and credential compromise to downstream business risk due to unauthorized access or fraud. The incident typifies the evolution of phishing as an industrialized, scalable ecosystem that increasingly relies on automation, AI-tailored content, and a broadening array of tactics. As these methods proliferate and become accessible to attackers with limited technical skills, organizations face heightened regulatory, operational, and reputational risks, making effective prevention and user awareness more vital than ever.
Phishing Campaign Exploits LastPass Users with Fake Vault Backup Alerts
In January 2026, LastPass warned users of a sophisticated phishing campaign impersonating official maintenance notifications, urging recipients to back up their password vaults within 24 hours. Attackers crafted convincing emails from spoofed senders with subjects stressing urgency, redirecting victims to a phishing site designed to harvest master passwords or hijack accounts. The campaign coincided with a U.S. holiday weekend, likely aiming to exploit periods of reduced staffing for more effective compromise. The prompt and widespread phishing attempt risked exposure of highly sensitive personal and business credentials, threatening downstream impacts and increased support demand for affected users and organizations. This incident highlights the ongoing evolution of credential harvesting campaigns and demonstrates how adversaries exploit times of operational vulnerability. The use of realistic messages and urgency tactics exemplifies broader trends in social engineering, reinforcing the necessity for user education, resilient authentication practices, and rapid response protocols to counteract increasingly common and dangerous phishing threats targeting password managers.
Patched Fortinet Firewalls Breached in 2026: Authentication Bypass Exposes Enterprise Networks
In January 2026, patched FortiGate firewalls running FortiOS versions 7.4.9 and 7.4.10 were actively breached due to exploitation of a lingering authentication bypass flaw (CVE-2025-59718) in the FortiCloud SSO login feature. Despite an earlier patch, attackers utilized crafted SAML messages to create rogue admin accounts on exposed devices, as observed in customer logs and confirmed by Fortinet developers. More than 11,000 Internet-facing Fortinet devices remained vulnerable as attackers leveraged the flaw to gain privileged access and potentially compromise network defenses, triggering urgent remediation efforts. This incident underscores persisting risks from incomplete remediation, especially on security appliances pivotal to organizational defenses. Growing attacker expertise in exploiting authentication logic flaws and a surge in identity-based attacks highlight the necessity for ongoing vigilance, layered compensating controls, and rapid vulnerability response strategies.
AI-Powered Android Malware Unleashes New Click-Fraud Wave via Xiaomi App Store
In January 2026, cybersecurity researchers at Dr.Web uncovered a sophisticated new Android malware family distributed via Xiaomi’s GetApps, popular third-party APK sites, and messaging platforms like Telegram and Discord. This malware leverages AI-driven image analysis using Google’s TensorFlow.js to identify and autonomously click on hidden browser ads within compromised apps, particularly games, simulating user behavior without obvious signs to victims. The malware is delivered through legitimate-looking apps, which update with malicious payloads post-installation. Impacts include increased battery consumption, higher data charges, and indirect monetization for attackers. This incident exemplifies the evolution of mobile ad fraud TTPs, as attackers increasingly deploy AI/ML for advanced automation and evasion. The trend signals rising risks to mobile advertising integrity and higher scrutiny for app stores’ vetting processes, especially on third-party and OEM-specific app markets.
CERT/CC Alert: binary-parser npm Vulnerability Puts Node.js Apps at Risk
In November 2025, a critical vulnerability (CVE-2026-1245) was disclosed in the widely used binary-parser npm library, enabling attackers to execute arbitrary JavaScript code on impacted Node.js applications. The issue stemmed from unsanitized user-supplied values in dynamically generated parser code, leaving systems relying on untrusted parser definitions open to privilege-level code execution and potential compromise of local data, application logic, or even execution of system commands. CERT/CC publicly warned about this supply-chain risk, urging organizations to upgrade to binary-parser v2.3.0 and avoid processing untrusted parser configurations. This incident is a stark reminder of the supply-chain risks inherent in open-source dependencies, especially those that permit dynamic code generation. As exploitation of package vulnerabilities continues to rise, regulators and CISOs are placing increasing importance on proactive dependency management and runtime validation in development and DevOps pipelines.
Chainlit 2026 Supply-Chain Flaws Let Hackers Breach Cloud AI Environments
In early 2026, two high-severity vulnerabilities ('ChainLeak') were discovered in Chainlit, a widely adopted open-source conversational AI framework, exposing cloud environments to significant risk. The flaws—CVE-2026-22218 (arbitrary file read) and CVE-2026-22219 (server-side request forgery)—could be exploited without user interaction, allowing attackers to access sensitive files and internal services on internet-facing production systems. Zafran Labs demonstrated that chaining both vulnerabilities enabled full-system compromise and lateral movement within enterprise cloud environments before a patch (v2.9.4) was released in December 2025. This incident highlights a growing threat vector in the AI software supply chain, especially as critical business and academic applications increasingly rely on rapidly evolving open-source frameworks. With adversaries targeting common components and fast-moving cloud deployments, organizations face pressure to update promptly and re-evaluate their security posture against similar zero-day and supply-chain risks.