Find what you’re looking for
Browse everything
6,877 results in Threat Reports
Trust Wallet Chrome Extension Breach: $8.5M Lost in Shai-Hulud Supply Chain Attack
In December 2025, Trust Wallet suffered a major supply chain attack targeting its Google Chrome browser extension. Attackers exploited leaked GitHub secrets to gain unauthorized access to Trust Wallet's source code and Chrome Web Store API keys, bypassing the firm’s standard release reviews. Malicious actors then uploaded a trojanized extension update that harvested user wallet mnemonic phrases and exfiltrated them to attacker-controlled infrastructure. The breach led to a rapid compromise of at least 2,520 digital wallets and the theft of approximately $8.5 million in cryptocurrency, prompting a large-scale reimbursement and investigation effort by Trust Wallet. This incident highlights the escalating trend of supply chain attacks exploiting trusted software dependencies and underscores the urgent need for rigorous release controls and key management in the software lifecycle.
Thousands Breached: The 2024 Ivanti EPMM Zero-Day APT Campaign
In April and May 2024, thousands of organizations worldwide were compromised after a Chinese state-sponsored advanced persistent threat (APT) group exploited multiple previously unknown zero-day vulnerabilities in Ivanti’s Endpoint Manager Mobile (EPMM) platform. The attackers used these flaws as entry points to gain administrative control, move laterally, and deploy persistent malware, leading to widespread data exfiltration and operational disruption. The campaign targeted government, critical infrastructure, and private sector entities, exploiting unpatched systems at scale before public disclosure, prompting rapid security advisories and emergency patching. This Ivanti EPMM incident underscores the growing sophistication of nation-state campaigns leveraging zero-day vulnerabilities for large-scale compromise. It highlights the urgent industry need for rigorous vulnerability management, zero trust architectures, and rapid detection in light of escalating APT tactics.
OpenAI Battles Prompt Injection Risk in ChatGPT Atlas Browser Agent (2024)
In mid-2024, OpenAI reported a significant security challenge involving prompt injection attacks targeting its ChatGPT Atlas browser agent. Internal automated red teaming uncovered advanced prompt injection techniques that manipulated the agent into executing unauthorized actions when it encountered maliciously crafted content, such as emails or web pages. The incident highlighted the potential for agents with access to sensitive workflows—like email or documents—to become high-value targets, with attackers abusing their autonomous capabilities to exfiltrate data or perform unintended tasks. OpenAI responded by updating the agent with an adversarially trained model and enhanced safeguards. This incident draws attention to the growing security risks associated with AI/ML agents operating within user workflows, as such attacks are becoming increasingly sophisticated and persistent. The event underscores a broader pattern of rising concern from regulators and security agencies regarding AI-driven exploits, especially as generative AI becomes deeply integrated into enterprise environments.
ErrTraffic ClickFix: The 2024 Malware Campaign Exploiting Fake Browser Glitches
In March 2024, security researchers uncovered a large-scale cybercriminal campaign leveraging a service named ErrTraffic to automate 'ClickFix' attacks via fake browser glitches. Threat actors compromised legitimate websites, deploying scripts to simulate error pop-ups and glitches that tricked users into downloading malicious payloads or executing harmful actions. The attackers utilized advanced social engineering, presenting credible browser dialog impersonations, and used the campaign to rapidly distribute information-stealing malware across multiple geographies. The impact included significant compromises of user credentials and personal information, highlighting growing risk to businesses reliant on web applications. This incident is particularly notable as it demonstrates both evolving infostealer TTPs and the increasing sophistication of social engineering through browser-manipulation. The widespread adoption of automated 'glitch' services like ErrTraffic signals a broader shift towards commoditizing web-based attacks targeting both enterprises and individuals.
CISA Warns of Critical 2025 ICS Vulnerabilities in WHILL C2 and AzeoTech DAQFactory
In December 2025, the Cybersecurity and Infrastructure Security Agency (CISA) publicly released advisories highlighting multiple serious vulnerabilities in two industrial control systems: the WHILL C2 Wheelchairs and AzeoTech DAQFactory software. These advisories outlined critical flaws that could permit unauthorized access, remote code execution, or control manipulation within industrial and healthcare environments if left unmitigated. Attackers exploiting these gaps could compromise patient safety with wheelchairs or disrupt automation and process monitoring within industrial facilities, directly impacting operational continuity and patient care. This disclosure underscores intensifying cybersecurity scrutiny of industrial and medical control systems, which are increasingly targeted due to digitization and legacy design shortcomings. The rapid emergence of similar threats and increased regulatory focus make swift mitigation and robust ICS security controls more vital than ever.
SmarterMail 2025: Critical Pre-Auth File Upload Flaw Threatens Global Email Servers
In December 2025, Singapore's Cyber Security Agency (CSA) issued an alert concerning a critical pre-authentication vulnerability (CVE-2025-52691) in SmarterTools SmarterMail email servers. The flaw allows unauthenticated remote attackers to upload arbitrary files to any location on the server, leveraging an unvalidated GUID parameter for path traversal via the '/api/upload' endpoint. An attacker could exploit this for remote code execution, potentially resulting in full compromise of the server, with malicious files executed under system privileges. Although no in-the-wild exploitation has been confirmed, more than 16,000 vulnerable public-facing servers were identified globally. This incident underscores growing risks from exposed infrastructure and rapid exploitation of high-severity application flaws. With threat actors increasingly targeting business-critical communication platforms, organizations face mounting pressure to quickly remediate vulnerabilities and bolster segmentation and detection capabilities in line with zero trust frameworks.
Kimwolf Botnet 2025: The Largest IoT Attack Forces Rethink of DDoS and Proxy Security
In 2025, a record-shattering wave of distributed denial-of-service (DDoS) and proxy attacks targeted high-profile websites including KrebsOnSecurity.com, Google, and Cloudflare. Initial attribution pointed to the Aisuru botnet, but subsequent investigation by XLab and others revealed the underlying infrastructure was largely driven by the Kimwolf botnet, comprising over 1.8 million compromised Internet-of-Things (IoT) devices. The attackers leveraged vulnerable connected devices worldwide, harnessing them not only for disruptive DDoS campaigns but also for proxy rental services that enabled cybercriminal anonymity, exposing widespread insecurity in IoT ecosystems. This incident underscores a concerning shift: major botnets are evolving from sporadic attacks to persistent, multi-purpose criminal platforms. It highlights the urgent need for enterprises to address IoT security gaps and for cloud providers to enforce robust countermeasures against residential proxy abuse and large-scale botnet activity.
ESA 2024 External Server Breach: Lessons on Third-Party and Perimeter Security
In June 2024, the European Space Agency (ESA) confirmed a cybersecurity incident involving unauthorized access to external servers outside its core corporate IT network. These servers contained 'unclassified' information tied to ESA's collaborative engineering activities. The breach was detected and announced on June 24, with the agency rapidly taking down the compromised servers to contain the incident and beginning an internal investigation. No critical or classified ESA infrastructure was reportedly affected, and mission operations remained unaffected. This breach underscores persistent risks facing organizations collaborating with external partners and utilizing externally accessible infrastructure. Similar methodologies targeting non-core systems and lateral movements are increasing, highlighting the importance of robust segmentation, external system monitoring, and continuous risk assessment for third-party assets.
Silver Fox Exploits Income Tax Phishing to Deploy ValleyRAT in India (2025)
In December 2025, the Chinese-origin threat group Silver Fox launched a sophisticated phishing campaign targeting Indian users with income tax-themed emails. Victims received emails purportedly from India’s Income Tax Department containing decoy PDF attachments. When recipients opened the PDFs, they were redirected to a malicious website serving a ZIP file with a trojanized installer. The infection leveraged DLL hijacking and a legitimate executable to sideload malware, ultimately installing ValleyRAT—a modular remote access trojan—by process hollowing. Once active, ValleyRAT enabled attackers to harvest credentials, establish persistence, and communicate via encrypted channels for ongoing control. This incident highlights the convergence of advanced phishing lures, supply chain manipulation, and evasive malware tailoring persistent access to high-value targets across public, financial, healthcare, and technology organizations. ValleyRAT’s modularity, anti-analysis features, and delayed communication underline a pivot towards low-noise, highly adaptive attacks exploiting human trust and regulatory touchpoints.
Critical Bluetooth Vulnerability Exposes WHILL Medical Wheelchairs
In December 2025, a critical IoT vulnerability (CVE-2025-14346) was disclosed in WHILL Model C2 Electric Wheelchairs and Model F Power Chairs, widely used in healthcare and public health sectors. Researchers discovered that these devices failed to enforce authentication for Bluetooth connections, enabling attackers within physical range to pair, take full control, issue movement commands, bypass safety restrictions, and alter configuration profiles with no user credentials required. The issue impacted all device versions, prompting emergency firmware mitigations from WHILL Inc. to restrict unauthorized access and manipulation. This incident underscores urgent risks associated with the growing attack surface in medical IoT and connected healthcare devices. Increasing reliance on wireless interfaces heightens exposure to exploitation, mandating stronger security and authentication measures as the threat landscape evolves.
MongoBleed 2025: Global Memory Leak Puts MongoDB Data at Risk
In December 2025, a high-severity vulnerability named MongoBleed (CVE-2025-14847) was identified in multiple MongoDB versions with default settings, allowing unauthenticated attackers to leak sensitive server memory, including credentials and access tokens. Public disclosure and proof-of-concept code triggered a surge in exploitation, leaving more than 75,000 vulnerable instances exposed globally. Security researchers highlight the ease of exploitation, scale of potentially affected organizations, and absence of forensic evidence, which complicates post-incident investigations and raises the risk of undetected data exposure. Countries most affected include China, the United States, and several European and Asian nations. This incident underscores the urgent risk posed by memory-leak vulnerabilities in widely deployed open-source technologies and highlights the accelerating cycle from disclosure to weaponization. It also signals how reduced staffing during holiday periods can hinder detection and response, contributing to lingering risks and delayed mitigation.
Coupang’s $1.17B Insider Data Breach Puts Spotlight on Retail Security
In June 2024, Coupang, South Korea’s largest online retailer, announced a data breach impacting 33.7 million customers after discovering unauthorized access to customer data in May 2024. The breach, attributed to an insider threat, exposed sensitive information including names, contact details, and purchase histories. Coupang committed $1.17 billion (1.685 trillion KRW) in compensation, underlining the massive scale and business impact. Investigations revealed misuse of privileged access led to the data exfiltration, making this one of Korea’s most significant consumer data breaches. This incident highlights escalating risks from insider threats amid expanding data footprints in retail and e-commerce. In the wake of regulatory scrutiny and increasing consumer privacy demands, organizations face mounting pressure to implement advanced east-west traffic monitoring, zero trust segmentation, and comprehensive anomaly detection to protect sensitive customer data.