Find what you’re looking for
Browse everything
6,844 results in Threat Reports
Atlas & Comet AI Sidebar Spoofing: How Attackers Are Hijacking Trust in Browser AI
In early June 2024, security researchers identified a novel application security vulnerability affecting OpenAI’s Atlas and Perplexity’s Comet browsers. Attackers leveraged spoofed AI sidebars to present malicious, AI-generated instructions that duped users into actions compromising security, such as running unverified commands or visiting phishing sites. The attack method bypassed traditional endpoint defenses by exploiting inherent trust in AI-powered browser features. Though no widespread exploitation has been confirmed, proof-of-concept demonstrations exposed a significant risk of credential theft, data leakage, or lateral movement within enterprise environments. The rapid adoption of AI assistants made this vector both timely and dangerous. This incident highlights the growing trend of attackers targeting AI-powered productivity tools by manipulating contextual interfaces. Rising adoption of AI chatbots and browser plugins increases the threat surface, demanding urgent reevaluation of security controls and staff awareness. Regulatory scrutiny of AI and application security is expected to accelerate in response.
CISA Sounds Alarm: Lanscope Endpoint Manager Flaw Actively Exploited
In June 2024, the Cybersecurity and Infrastructure Security Agency (CISA) warned organizations of active exploitation of a critical vulnerability in Motex’s Lanscope Endpoint Manager software. Threat actors leveraged the flaw (tracked as CVE-2024-27956) to gain unauthorized access and potentially execute remote code on unpatched systems. The attackers could bypass authentication and gain administrative privileges, enabling lateral movement and further compromise of affected network environments. The incident impacted enterprises using Lanscope Endpoint Manager for device monitoring and management, raising concerns over exposure of sensitive data and operational disruption. This incident is notable for its speed of exploitation following public disclosure, illustrating the ongoing trend of threat actors rapidly weaponizing software vulnerabilities in endpoint management tools. The breach underscores the importance of immediate patching and rigorous monitoring as attackers increasingly target IT infrastructure software to establish initial footholds.
Toys "R" Us Canada Faces Customer Data Leak in 2024 Breach
In late April 2024, Toys "R" Us Canada disclosed a data breach after threat actors exfiltrated and subsequently leaked customer records from its systems. The breach was confirmed via direct customer notifications, revealing that sensitive customer data—including names and contact details—was stolen and made public on a hacker forum. The company identified the security incident after discovering that attackers had gained unauthorized access and were able to access certain internal systems, leading to the data leak. Following the discovery, Toys "R" Us Canada initiated an investigation and notified the affected individuals, emphasizing that payment information was not compromised. This incident highlights a continued trend of cybercriminals targeting retail and e-commerce sectors for customer data theft and exposure. The breach exemplifies the increasing frequency of attacks leveraging stolen credentials or vulnerable infrastructure, underlining the urgent need for robust data protection and threat monitoring strategies across all consumer-facing organizations.
Over 250 Magento Stores Breached Overnight Through Critical Adobe Commerce Flaw
In October 2025, over 250 Magento and Adobe Commerce online stores were compromised in less than 24 hours after attackers exploited a newly disclosed critical vulnerability, CVE-2025-54236 (CVSS 9.1). The flaw, stemming from improper input validation, allowed threat actors to compromise e-commerce shops directly via their web applications, enabling unauthorized access, data exfiltration, and potential payment card theft. Security researchers observed an automated wave of exploitation attempts soon after public disclosure, underlining how rapidly threat actors weaponize emerging vulnerabilities for financial gain and to cause operational disruption. This incident highlights the urgent need for rapid patch management and layered web application defenses, as attackers increasingly leverage zero-day and recently disclosed vulnerabilities to target widely used commerce platforms, further increasing risks to consumer data and regulatory compliance for online retailers.
CISA Confirms Critical Lanscope Endpoint Manager Vulnerability Under Active Attack
In October 2025, a critical vulnerability (CVE-2025-61932, CVSS 9.3) in Motex Lanscope Endpoint Manager was added to CISA’s Known Exploited Vulnerabilities catalog after confirmed active exploitation in the wild. Attackers leveraged the on-premises endpoint management platform’s remote code execution flaw to obtain unauthorized access, enabling lateral movement and potential data exfiltration. Organizations relying on Lanscope Endpoint Manager may face business disruption, data integrity issues, and heightened regulatory scrutiny as a result of this exposure. The recent exploitation of this vulnerability underscores a larger trend of remote code execution exploits targeting widely deployed endpoint management products. With attackers increasingly seeking supply-chain and IT management footholds, regulatory bodies and security leaders are prioritizing rapid patch cycles and robust segmentation to limit risk.
Jingle Thief: How Hackers Exploited Cloud to Steal Millions in Retail Gift Cards (2025)
In October 2025, a cybercriminal group known as Jingle Thief orchestrated a sophisticated financial fraud campaign targeting retail and consumer services organizations operating in cloud environments. Leveraging phishing and smishing tactics to obtain employee credentials, the attackers gained access to cloud-based systems responsible for managing digital gift card issuance. Once inside, they exploited weak east-west traffic controls and lack of adequate segmentation to move laterally and automate gift card theft at scale, resulting in losses worth millions of dollars and significant operational disruption to affected businesses. This incident highlights an ongoing escalation in targeted cloud infrastructure attacks, especially towards retail functions involving financial assets like digital gift cards. The use of cloud-native attack vectors and credential phishing underscores the urgency for enhanced zero trust practices, robust detection controls, and strict policy enforcement to protect sensitive assets in distributed environments.
North Korean APTs Breach UAV Defense Firms Using Fake Job Offers (2025)
In October 2025, multiple European defense contractors specializing in unmanned aerial vehicles (UAVs) were targeted by a sophisticated cyber-espionage campaign attributed to North Korean threat actors, commonly known as Lazarus Group. The attackers masqueraded as recruiters and leveraged convincing fake job offers to defense engineers using social networks and spear-phishing emails, ultimately delivering malicious payloads that provided remote access to corporate networks. The primary objective was to exfiltrate proprietary drone technology and sensitive internal communications, resulting in significant intellectual property theft and exposure of confidential project details. This incident illustrates a persistent trend where state-sponsored actors target the defense sector’s engineers with social engineering tactics, reflecting a broader escalation in advanced persistent threat (APT) campaigns leveraging human-centric attack vectors. Organizations face mounting regulatory scrutiny and must enhance security controls to combat these evolving social-engineering-enabled threats.
It Only Takes 250 Documents to Poison Any Large Language Model – Security Implications for 2024
In 2024, cybersecurity researchers demonstrated that the integrity of large language models (LLMs) can be severely compromised with as few as 250 poisoned documents strategically inserted into their training data. By covertly introducing manipulated or malicious content into public data sources, attackers can alter a model’s understanding, bias its outputs, or degrade its reliability. This proof-of-concept highlights that ‘data poisoning’ attacks require minimal input yet pose substantial risk for AI reliability, potentially opening the door for misinformation, backdoors, or loss of operational trust across industries leveraging AI. Organizations relying on LLMs for critical tasks face a heightened threat of silent, hard-to-detect breaches affecting their core AI deployments. The urgency around AI/ML supply chain security has intensified, as threat actors and researchers increasingly explore the feasibility of data poisoning. Regulatory frameworks and industry best practices now emphasize the need for data provenance controls and continuous integrity monitoring of training pipelines.
Mideast & African Hackers Launch Multi-Vector Attacks on Governments, Banks, and Retailers in 2024
In early 2024, multiple threat groups originating from the Middle East and Africa executed a series of sophisticated, multi-vector cyber campaigns targeting government agencies, banks, and small to midsize retailers across the region. Attackers leveraged a blend of techniques including encrypted traffic evasion, lateral movement, cloud misconfiguration, and remote access tools. These campaigns exploited gaps in east-west security, egress controls, and cloud segmentation, resulting in data exfiltration, service disruptions, and operational downtime across multiple sectors. The tactics exposed critical weaknesses in hybrid cloud architectures, impacting regulatory compliance and eroding trust in public and financial institutions. This incident highlights the escalating trend of advanced regional threat actors targeting not just political or large economic entities, but also smaller businesses, using methods that combine traditional and cloud-native attack vectors. The frequency and sophistication of such attacks underscore the need for adaptive, zero trust security frameworks and heightened vigilance across both public and private sectors.
Inside the 2024 Lazarus Group Attack on European Drone Manufacturers
In early 2024, the North Korean-backed Lazarus Group launched a sophisticated cyber-espionage campaign targeting multiple European drone manufacturers. The operation leveraged spear-phishing emails and custom malware to gain unauthorized access to sensitive research, development, and operational data. After establishing persistence, attackers conducted lateral movement across corporate networks and exfiltrated significant volumes of intellectual property and proprietary technology aligning with North Korea's strategic interests. The breach undermined victims’ competitive advantage, presented potential national security risks, and exposed critical supply chain vulnerabilities. The incident underscores the escalation of state-sponsored attacks against the European defense and aerospace sector. As APT groups like Lazarus intensify targeting of high-innovation industries using stealthy techniques, organizations face mounting pressure to strengthen east-west traffic monitoring, encryption practices, and zero trust segmentation.
The 2024 Global Smishing Deluge: China-Based SMS Phishing at Scale
In early 2024, a China-based threat group orchestrated a massive global smishing campaign, flooding mobile devices across multiple continents with fraudulent SMS messages impersonating banks, government agencies, and delivery services. Leveraging a rapidly-evolving attack ecosystem, the actors utilized wide-scale automation and regional tailoring to bypass spam filters and trick users into revealing sensitive credentials or installing malware. The attack’s magnitude caught many organizations off guard, resulting in significant credential theft, unauthorized transactions, and growing operational strain as firms raced to block fast-moving SMS domains and educate affected users. This campaign signals a sharp escalation in the sophistication and reach of smishing attacks, highlighting persistent gaps in mobile security awareness and detection. As similar TTPs gain traction among organized threat groups, critical infrastructure and commercial service providers face increased risks of large-scale credential exposure and downstream fraud.
F5 2025 Supply-Chain Breach: Nation-State Attackers Target Update Infrastructure
In October 2025, F5 Networks—an industry-leading provider of enterprise networking and security appliances—disclosed a sophisticated supply-chain breach attributed to a nation-state threat actor. Attackers maintained long-term, covert access to F5’s internal environment, ultimately compromising systems responsible for building and distributing software updates for its widely deployed BIG-IP products. The breach allowed unauthorized access to proprietary source code, documentation of unpatched vulnerabilities, and a trove of sensitive customer configuration data, significantly enlarging the risks of downstream exploitation for thousands of major enterprises and critical infrastructure providers globally. This incident underscores the growing threat of highly persistent, technically advanced supply-chain attacks targeting the software build and delivery processes of core technology vendors. The breach reflects recent escalation in nation-state tactics and highlights the continued exposure of global businesses to supply-chain and software update system threats.