Find what you’re looking for
Browse everything
6,867 results in Threat Reports
2025 Cyberattack Wave: USB Malware, React2Shell & AI Tool Exploits Expose Security Gaps
In December 2025, organizations worldwide faced a surge of multi-vector cyberattacks exploiting recent vulnerabilities in USB devices, popular developer frameworks like React (notably the React2Shell bug), and emerging AI-powered coding environments. Attackers leveraged unpatched software, social engineering, and compromised USB devices to distribute malware and establish lateral movement within networks. The campaign capitalized on the rapid deployment of new technologies and lagging security controls, resulting in data breaches, financial theft via sophisticated WhatsApp worms, and the infiltration of development pipelines. This spate of incidents underscores the escalating convergence of traditional malware vectors and AI-driven exploits, exposing significant gaps in current security postures. As organizations accelerate digital transformation and adopt generative AI tools, adversaries are rapidly evolving, testing defenses across cloud, hybrid, and on-premises ecosystems.
JS#SMUGGLER Campaign: How Compromised Websites Delivered NetSupport RAT in 2025
In December 2025, cybersecurity researchers discovered a widespread campaign called JS#SMUGGLER leveraging compromised websites to deliver NetSupport RAT, a versatile remote access trojan. The attack chain involved injecting obfuscated JavaScript loaders onto legitimate sites, which delivered device-aware, multi-stage payloads via hidden iframes, HTML application (HTA) loaders, and encrypted PowerShell scripts. This sophisticated approach enabled attackers to remotely control infected hosts, exfiltrate sensitive data, and evade detection through in-memory and fileless techniques. The campaign targeted enterprise users indiscriminately and was attributed to yet-uncategorized threat actors, though infrastructure overlap with SmartApeSG was noted. The incident is a timely reminder of advancing web-based malware deployment tactics, blending script obfuscation, evasive loaders, and context-aware delivery. As enterprises increasingly rely on web interfaces and remote access, defenders face mounting pressure to detect, segment, and monitor east-west and egress network activity in real time to thwart lateral movement and data theft.
Wave of Android Malware Hits Polish Bank Customers—FvncBot, SeedSnatcher & ClayRat Evolve
In late 2025, security researchers from Intel 471, CYFIRMA, and Zimperium uncovered two new Android malware families—FvncBot and SeedSnatcher—alongside an upgraded ClayRat variant. FvncBot, disguised as a banking security app targeting mBank customers in Poland, used sophisticated credential theft and evasive techniques to breach users’ devices, while SeedSnatcher enabled wide-scale stealth data exfiltration. ClayRat, already known in cybercriminal circles, has evolved to feature enhanced capabilities for data theft and persistence. These malware strains are distributed through phishing campaigns and malicious app stores targeting finance sector customers and exploiting gaps in mobile device controls and user awareness. The campaigns resulted in substantial risk of unauthorized transactions, identity theft, and broader exposure of banking and personal data. The coordinated discovery highlights a dramatic escalation in the capabilities of mobile-targeted malware, especially those aimed at financial institutions in Eastern Europe. The incident exemplifies the rapid, continuous innovation by threat actors seeking to monetize weaknesses in endpoint security and exploit unsuspecting app users, raising the urgency for organizations to modernize mobile and app-layer security postures.
Active Exploitation of React2Shell: How Chinese APTs Breached the Supply Chain in 2025
In December 2025, security researchers identified a critical vulnerability, CVE-2025-55182 (React2Shell), actively exploited in the wild by suspected Chinese threat actors Earth Lamia and Jackpot Panda. The flaw impacts React Server Components in several Meta-maintained packages (versions 19.0 to 19.2.0), allowing attackers to execute arbitrary code on backend servers via unsafe deserialization at API endpoints. First reported by AWS Threat Intelligence on December 4, evidence ties multiple untracked clusters and IP addresses to coordinated supply-chain attacks targeting organizations operating modern web stacks. In successful compromises, attackers gained full backend access, posing serious risks to enterprise data and operations. This incident underscores the rapid weaponization of supply-chain vulnerabilities and the growing sophistication of state-aligned APTs exploiting core software dependencies. React2Shell highlights the urgent need for rigorous patch management, attack surface monitoring, and proactive defense as critical technologies become frequent entry points for advanced adversaries.
CISA Flags Active D-Link & Array Networks Vulnerabilities in 2025 KEV Catalog
In December 2025, the Cybersecurity and Infrastructure Security Agency (CISA) expanded its Known Exploited Vulnerabilities (KEV) Catalog to include two actively exploited vulnerabilities: CVE-2022-37055, a buffer overflow in D-Link routers, and CVE-2025-66644, an OS command injection flaw impacting Array Networks ArrayOS AG. These vulnerabilities provide attack vectors for cybercriminals to gain unauthorized access, conduct lateral movement, or exfiltrate sensitive data within federal and private sector networks. The directive mandates that all Federal Civilian Executive Branch (FCEB) agencies address these threats promptly to reduce risk exposure and protect operational integrity. This update underscores the persistent threat posed by unpatched network infrastructure vulnerabilities, which remain prime targets for attackers. Timely remediation of KEV-listed vulnerabilities is increasingly critical for all organizations amid a rising trend of targeted attacks against widely deployed network devices.
Broadside Mirai Variant Disrupts Maritime Logistics Sector in 2024
In early 2024, a novel Mirai variant dubbed 'Broadside' was discovered targeting maritime logistics organizations by exploiting a critical command injection flaw in exposed DVR systems. Attackers leveraged this vulnerability to gain persistent access, hijack the devices, and enable lateral movement across internal shipping infrastructure. Once compromised, infected endpoints became part of a botnet, amplifying the campaign’s impact and potentially threatening the operational continuity of global maritime logistics firms. The incident underscores growing risks faced by critical infrastructure sectors as IoT-targeting malware evolves. Mirai and its variants continue to adapt, now seeking less-conventional, specialized equipment in sectors previously overlooked, further complicating defense and regulatory compliance for logistics organizations worldwide.
React2Shell Vulnerability Triggers Mass Breach Across 30+ Organizations in 2025
In early 2025, researchers discovered that over 77,000 internet-exposed IP addresses are vulnerable to a critical Remote Code Execution (RCE) flaw in the React2Shell framework (CVE-2025-55182). Threat actors rapidly exploited this vulnerability to breach at least 30 organizations across sectors such as finance, healthcare, and technology. Attackers leveraged the exploit to gain remote control, exfiltrate data, and potentially deploy malware across impacted systems, highlighting significant risks to operational resilience and data privacy. The compromised firms are now racing to contain lateral movement and mitigate exposure amid ongoing incident response. This incident illustrates a growing trend of attackers rapidly weaponizing newly disclosed vulnerabilities in popular frameworks for mass exploitation. It underscores the urgent need for timely patch management, robust segmentation, and comprehensive monitoring to counter the escalating threat from opportunistic RCE attacks targeting exposed internet-facing assets.
Escalating Credential Attacks on Palo Alto GlobalProtect VPNs: 2024 Threat Review
In early 2024, cybersecurity analysts observed a widespread campaign targeting Palo Alto Networks’ GlobalProtect VPN portals and SonicWall SonicOS API endpoints with aggressive login attempts and scanning activity. Threat actors used automated tools to conduct credential stuffing and exploit potential vulnerabilities in exposed VPN portals, aiming to gain unauthorized network access. While no specific breaches were confirmed, the campaign's scope affected numerous organizations globally relying on these remote access solutions, highlighting the heightened risk to large enterprises and managed service providers leveraging vulnerable or misconfigured VPN infrastructure. This incident illustrates the surge in identity-driven and credential-based attacks exploiting remote access technologies, especially as hybrid and remote workforces remain prevalent. The rapid evolution and broad targeting underscore the urgent need for continuous VPN hardening, robust access governance, and threat monitoring to preempt similar intrusion attempts impacting business continuity.
Critical React2Shell Flaw (CVE-2025-55182) Added to CISA KEV After Confirmed Exploitation
In June 2025, a critical remote code execution (RCE) vulnerability, CVE-2025-55182, impacting React Server Components (RSC) was added to CISA's Known Exploited Vulnerabilities catalog following confirmed reports of active exploitation. Attackers leveraged the flaw, known as 'React2Shell,' to execute arbitrary code on vulnerable servers by exploiting inadequate input validation, enabling lateral movement and potential compromise of sensitive systems and data. Several organizations in sectors reliant on JavaScript-based web infrastructures were affected, resulting in service disruptions and the risk of unauthorized data access and exfiltration. This incident highlights a broader trend in targeting supply chain and open-source components within modern web development stacks. The increasing frequency and sophistication of attacks on widely adopted frameworks like React underscore the urgency for rapid vulnerability remediation, improved code validation, and enterprise adoption of proactive threat detection to mitigate future large-scale RCE campaigns.
AI IDEsaster: 30+ Vulnerabilities Expose Developer Environments to Prompt Injection & RCE (2025)
In December 2025, over 30 serious security flaws—collectively named "IDEsaster"—were uncovered in popular AI-powered Integrated Development Environments (IDEs) by researcher Ari Marzouk (MaccariTA). Exploiting these vulnerabilities, attackers could inject malicious prompts, leading to unauthorized data exfiltration and remote code execution within developer environments. The flaws stemmed from unsafe integrations of AI features, including insufficient sandboxing and lack of network traffic controls, exposing sensitive code and credentials to threat actors. Notably, vulnerabilities allowed for lateral movement and direct access to code repositories, risking business continuity and intellectual property. This incident is especially significant as AI adoption in coding workflows accelerates, creating new attack vectors. The surge in prompt injection and AI supply chain threats, paired with evolving attacker tactics targeting developer tools, highlights the urgent need for organizations to strengthen segmentation, monitoring, and AI risk governance.
How MCP Prompt Injection Attacks Bypassed AI Security Controls in 2024
In early 2024, cybersecurity researchers from Unit 42 uncovered a series of novel prompt injection attack vectors targeting applications built on the Model Context Protocol (MCP), an emerging technology that connects large language models (LLMs) to external data sources and tools. Threat actors exploited weaknesses in MCP sampling to inject malicious prompts, enabling sensitive data exfiltration, command execution, and unauthorized access to downstream APIs. The compromised LLM applications posed significant risks across industries utilizing MCP to enhance automation and efficiency, ultimately raising concerns over AI/ML-powered business processes. The attack highlighted urgent visibility, policy enforcement, and segmentation shortfalls in cloud-native environments. The MCP prompt injection incident underscores a surge in AI-driven threats, particularly as generative AI is rapidly being integrated into enterprise workflows. Regulatory bodies and CISOs now place a premium on robust framework adherence and continuous monitoring as generative AI vulnerabilities and supply-chain risks multiply.
Cloudflare 2024 Outage: Why Network Resilience and Redundancy Matter More Than Ever
On June 20, 2024, Cloudflare, a major internet infrastructure and security provider, suffered a widespread service outage that disrupted access to thousands of websites and web services globally. The event was characterized by persistent 500 Internal Server Error messages for end users. Cloudflare initiated an internal investigation, ultimately attributing the incident to a critical infrastructure failure rather than a cyberattack or external threat. Throughout the outage, web-facing businesses, SaaS providers, and end-users experienced degraded network performance, extended downtime, and impact to brand trust, illustrating the magnitude of hyperscaler dependencies. The Cloudflare outage highlights the increasing risks associated with concentration of critical internet services and underscores the urgency for organizations to bolster resilience strategies. In an era of heightened service interdependencies and upticks in both incidents and attacks targeting fundamental service providers, outage preparedness and robust incident response planning are more essential than ever.