Find what you’re looking for
Browse everything
6,877 results in Threat Reports
Zendesk 2024 Spam Attacks Expose SaaS Security Gaps
In June 2024, multiple organizations using Zendesk experienced a widespread spam campaign that abused legitimate Zendesk instances to distribute malicious and unwanted emails. Attackers leveraged open or misconfigured support ticketing forms, submitting large volumes of spam through these systems. The CRM vendor Zendesk responded by assuring customers that the event was not tied to any software vulnerability or security breach within the platform itself. Business impact centered on increased phishing risk and operational noise in customer service channels, as well as potential reputational harm to affected brands. This incident highlights a growing trend where attackers abuse trusted SaaS communication channels to bypass traditional email security filters. As threat actors increasingly focus on exploiting third-party platforms and automation, organizations face new challenges securing digital touchpoints against social engineering and spam-based threats.
Visual Studio Code: The Hidden Supply-Chain Threat Targeting Developers (2024)
In January 2024, a novel supply-chain attack vector targeting Visual Studio Code (VSCode) environments was exposed. Threat actors leveraged VSCode's task automation feature by embedding malicious scripts within project-level '.vscode/tasks.json' files. When an unsuspecting developer opened a compromised repository or project directory, these hidden tasks executed automatically, enabling code execution—potentially leading to malware installation, data exfiltration, or further lateral movement within the developer’s environment. The attack mimics macro-style threats seen in Office documents, utilizing obfuscated scripts and exploiting legitimate productivity features to bypass traditional security controls. This breach highlights the growing exploitation of developer tools as initial intrusion points, particularly given the increased reliance on open-source ecosystems and extensions. Supply-chain attacks via development environments are on the rise, pressuring organizations to improve oversight of internal code, dependencies, and automated scripts. Vigilance around workspace configuration files, especially auto-executing tasks, is now critical for enterprise security posture.
How an Azure Private Endpoint DNS Misconfiguration Triggered Massive DoS Risks in 2026
In January 2026, security researchers highlighted a critical cloud misconfiguration affecting Microsoft Azure’s Private Endpoint architecture that could trigger denial-of-service (DoS) conditions. Specifically, Azure Private Link’s DNS resolution behavior was shown to inadvertently block access to resources—including Azure Storage, Key Vault, CosmosDB, and others—when Private DNS zones were misconfigured. The risks arise in accidental and malicious deployment scenarios, where incomplete or improper DNS records prevent workloads from connecting, despite the underlying resource being online. This exposure reportedly affects over 5% of Azure storage accounts, posing operational disruption risks through simple configuration errors or targeted attacker activity. This incident underscores the increasing complexity and fragility of cloud-native networking, as organizations accelerate the adoption of zero trust and segmentation patterns. With threat actors and insider mistakes both leveraging subtle service settings, this serves as an urgent reminder that cloud misconfiguration remains a leading cause of outages and breaches.
Google Gemini AI Breach: Prompt Injection Attack Exposes Enterprise Calendar Data
In January 2026, researchers at Miggo Security demonstrated a semantic prompt injection attack against Google Gemini, the company’s flagship AI assistant integrated across Google Workspace. By sending a maliciously crafted Calendar invitation containing natural-language instructions in the event’s description, attackers could leverage Gemini’s automated parsing and task execution to exfiltrate sensitive calendar data. When a victim queried Gemini about their schedule, the model would follow the embedded instructions, summarize all meetings—including private ones—and leak the information by generating a new event visible to the attacker. This bypassed existing filtering mechanisms and exposed data without explicit user approval. The incident underscores the rising concern over generative AI systems’ susceptibility to context-driven prompt injection and logic abuse. It highlights an urgent need for context-aware and semantic-level defenses in AI-integrated business applications, as AI assistants become deeply embedded in productivity suites throughout the enterprise sector.
VoidLink Malware: How AI Accelerated a New Breed of Cloud Attacks
In late November 2025, researchers identified the VoidLink malware framework targeting Linux-based cloud servers. Distinct for its use of AI-driven development, VoidLink was built by a single operator primarily using the TRAE SOLO AI assistant, leading to an advanced, feature-rich malware toolkit in under a week. The incident became public after the attacker inadvertently exposed critical code, documentation, and sprint plans via an unsecured open directory, allowing security analysts to trace the rapid, AI-assisted development timeline and examine the malware’s architecture, which included custom loaders, implants, and rootkit modules for stealth and evasive operations. VoidLink represents the first extensively documented case of a sophisticated threat being produced predominately through AI modeling and automation. Its rapid development cycle and advanced modularity demonstrate the growing capability for individuals or small groups to deploy complex attacks once reserved for well-resourced threat actors—an evolution that underscores urgent challenges for enterprise security teams and the mitigation of future AI-driven threats.
Critical 2026 WordPress ACF Extended Vulnerability Exposes 50,000 Sites to Admin Takeover
In January 2026, a critical privilege escalation vulnerability (CVE-2025-14533) was discovered in the ACF Extended plugin for WordPress, which is active on over 100,000 sites. The flaw enables unauthenticated, remote attackers to create or update user accounts with arbitrary roles, including administrator, by abusing weak form restrictions in plugin versions 0.9.2.1 and earlier. Although the vulnerability requires sites to use specific forms with a role field, compromise enables full site takeover and administrative control. The issue was responsibly disclosed in December 2025 and patched four days later, but nearly half of the installed base reportedly remained exposed at the time of reporting. This incident accentuates the persistent risk posed by third-party plugin vulnerabilities in WordPress ecosystems and the widespread targeting of such platforms by malicious actors. With large-scale enumeration and exploitation of plugin flaws on the rise, organizations should prioritize rapid patching and robust privilege segmentation to reduce their exposure.
Evelyn Stealer Exposes Developer Credential Risks in VS Code Supply Chain
In January 2026, researchers uncovered a malware campaign exploiting the Microsoft VS Code extension ecosystem to deliver Evelyn Stealer, an infostealer targeting software developers. Threat actors distributed malicious extensions which downloaded and executed a secondary payload, ultimately injecting the stealer into a legitimate process. Once executed, the malware harvested sensitive information—including developer credentials, stored cookies, crypto wallets, and system data—then exfiltrated these assets via FTP to a remote server. Attackers also deployed anti-analysis and evasion techniques, enabling seamless and covert data theft that potentially compromised broader organizational systems by abusing developer environments as entry points. This attack underscores the growing risks to the software supply chain, as developer tools become lucrative vectors for credential and asset theft. The Evelyn Stealer incident reflects an expanding trend where infostealers leverage trusted development ecosystems, highlighting the urgent need for stronger security controls and supply chain hygiene in rapidly evolving threat landscapes.
2026 JavaScript Secrets Leak: Tens of Thousands of API Tokens Exposed in Production Web App Bundles
In January 2026, a sweeping automated analysis uncovered the exposure of over 42,000 sensitive API tokens—including GitHub, GitLab, Slack, Linear, and other SaaS access keys—in JavaScript bundles of live, internet-facing web applications. The research, conducted at massive scale across 5 million applications, revealed that traditional infrastructure and application security scanners consistently missed these secrets, leaving organizations exposed to repository breaches, data leaks, and system compromise. Critical tokens found enabled attackers to access private code, internal projects, downstream services, and business-critical data, demonstrating broad gaps in application supply chain controls. This incident highlights persistent shortcomings in secrets detection across the application lifecycle. As businesses accelerate cloud adoption, CI/CD automation, and shift-left security, the failure of both automated scanners and static analysis to catch secrets in deployed JavaScript highlights urgent challenges. The trend will likely intensify with rising use of contemporary development pipelines and AI-generated code.
Cloudflare ACME WAF Bypass: How a 2026 Edge Vulnerability Left Origins Exposed
In January 2026, Cloudflare disclosed and remediated a critical vulnerability in its ACME (Automatic Certificate Management Environment) HTTP-01 validation process. The flaw allowed attackers to craft requests that bypassed Cloudflare's Web Application Firewall (WAF), gaining unauthorized access to protected origin servers by exploiting the path handling for ACME challenges. There is no evidence of mass exploitation, but the vulnerability exposed the underlying infrastructure to potential attacks until it was patched. Cloudflare identified, investigated, and quickly deployed a fix to mitigate further risk to its global customer base. The incident highlights the ongoing importance of robust validation logic and continuous testing in security edge infrastructure. As attackers adapt to complex cloud architectures, bypass techniques targeting certificate management or internal authentication flows are increasingly relevant for organizations using shared security platforms.
Tudou Guarantee Shuts Down Telegram Transactions After $12B Crypto Fraud Wave
In January 2026, Tudou Guarantee Marketplace, a major Telegram-based platform known for facilitating illicit services and cryptocurrency fraud, halted its public Telegram transactions after processing over $12 billion in suspicious activity. This dramatic step followed the arrest of Chen Zhi, CEO of Prince Group, whose organization was linked to large-scale scam operations including forced labor, romance scams, and investment fraud. The sudden drop in wallet activity suggests a direct link to recent law enforcement action targeting Southeast Asian scam networks. This incident highlights the persistent risks of unregulated messaging platforms in enabling transnational cybercrime and the growing technological sophistication behind crypto-related fraud. With law enforcement crackdowns intensifying and marketplaces shifting tactics, organizations must update controls against social engineering, identity abuse, and crypto laundering.
Exposing the Hidden Threat: Orphan Accounts and the Identity Dark Matter (2026)
In January 2026, the cybersecurity community highlighted mounting risks associated with orphaned accounts—dormant but still-active identities left behind after employee turnover, organizational change, or fragmented onboarding processes. Attackers have repeatedly leveraged these unattended, often highly privileged accounts as entry points, as seen in notable breaches such as Colonial Pipeline (2021) and a 2025 ransomware attack on a manufacturing firm. These accounts evade detection and deprovisioning, undermining traditional Identity and Access Management (IAM) controls and enabling credential-based attacks that can lead to regulatory violations, operational inefficiencies, and delayed incident response. Such orphaned identities are a growing concern amid expanding use of non-human and AI-driven service accounts, especially following M&A activity. Their proliferation reflects a macro trend in attacker tactics: exploiting visibility and lifecycle gaps in identity governance—putting critical compliance frameworks and business continuity at risk.
LinkedIn Phishing Campaign Delivers RAT via DLL Sideloading—2026 Incident Analysis
In January 2026, security researchers identified a sophisticated phishing campaign exploiting LinkedIn direct messages to deliver weaponized WinRAR self-extracting archives targeting high-value individuals. Attackers used social engineering to establish trust, convincing victims to download an archive containing a legitimate open-source PDF reader, a malicious DLL, the Python interpreter, and a decoy file. Upon execution, the PDF reader sideloaded the malicious DLL, which deployed the Python interpreter, created persistence via a Registry Run key, and executed Base64-encoded shellcode in memory. This led to covert remote access, data exfiltration, and enabled attackers to move laterally across networks. The incident underscores a broader trend of attackers abusing social media platforms for initial access, bypassing traditional email-centric defenses, and leveraging open-source tools with advanced evasion techniques like DLL sideloading. As social engineering campaigns diversify across communication channels, all business sectors face amplified risks of stealthy malware delivery and long-term compromise.