Find what you’re looking for
Browse everything
6,854 results in Threat Reports
ClickFix Campaigns Weaponize Trust: How Attackers Abuse Legitimate Services
ClickFix campaigns represent a sophisticated social engineering attack vector where threat actors disguise malicious PowerShell scripts as legitimate software fixes or updates. These campaigns typically begin with phishing emails or compromised websites that present users with fake error messages, prompting them to copy and execute PowerShell commands that appear to resolve technical issues. The attacks leverage trusted platforms like GitHub, Discord, and legitimate cloud services to host malicious payloads, making detection more challenging for traditional security tools. Once executed, the malicious scripts establish persistent access through various techniques including scheduled tasks, registry modifications, and deployment of remote access tools, allowing attackers to maintain long-term presence in compromised environments. ClickFix campaigns have gained significant traction in 2024 as organizations increasingly adopt cloud-first strategies and remote work models, creating expanded attack surfaces that threat actors exploit through social engineering rather than traditional technical vulnerabilities.
StyleSmuggler Zero-Day: How CVE-2026-75650 Compromised Magento E-commerce Security
In September 2026, threat actors began exploiting CVE-2026-75650 (StyleSmuggler), a critical zero-day vulnerability in Adobe Commerce and Magento Open Source with a CVSS score of 10.0. The flaw allows unauthenticated remote code execution through PHP code injection in Magento's template system, specifically targeting the 'Payment Transaction Failed Reminder' email function. Attackers deployed sophisticated payloads including a Rust-based Linux backdoor and PHP web shells on compromised e-commerce sites, with exploitation beginning September 4, 2026. This incident highlights the growing sophistication of supply chain attacks targeting e-commerce platforms, as attackers increasingly focus on high-value web applications that process financial transactions and customer data, demonstrating the critical need for runtime application security controls.
Grindr's £26 Million Settlement Exposes Critical Gaps in Dating App Data Privacy
In September 2026, Grindr agreed to pay £26 million ($35.1 million) to settle a U.K. class action lawsuit involving over 10,000 users whose sensitive personal data, including HIV status, was shared with third-party advertising companies Apptimize and Localytics between 2018-2020. The incident, originally exposed by Norwegian research group SINTEF in April 2018, occurred while Grindr was owned by Chinese gaming company Kunlun, before its 2020 acquisition by San Vicente Acquisition LLC. The settlement covers historical data practices that violated U.K. privacy laws through unauthorized sharing of location data, sexual orientation, and medical information for commercial advertising purposes. This incident highlights the ongoing regulatory scrutiny of data privacy violations in dating apps and social platforms, particularly as GDPR enforcement intensifies and class action lawsuits become more prevalent in addressing historical privacy breaches involving sensitive personal information.
BengalSEO Campaign Weaponizes Search Results for MayaBot Distribution
The BengalSEO campaign represents a sophisticated search engine optimization poisoning operation that has been active since 2015, targeting Bing search results to deliver MayaBot malware and facilitate tech support scams. Operating from Rajasthan, India, the threat actors behind this campaign manipulate search engine results to redirect victims to malicious websites, where they deploy malware or engage in fraudulent technical support schemes. The campaign demonstrates the evolution of SEO poisoning techniques and their effectiveness in reaching unsuspecting users through legitimate search queries. This incident highlights the growing sophistication of search engine manipulation attacks and their integration with traditional malware distribution methods. As organizations increasingly rely on digital visibility and search engine optimization, the weaponization of these same techniques by threat actors represents a significant shift in attack vectors that security teams must address.
Critical FreeIPA Vulnerability Exposes Enterprise Authentication Infrastructure to Anonymous Attackers
In September 2026, Red Hat disclosed a critical vulnerability chain in FreeIPA (CVE-2026-76578) with a CVSS score of 9.8 that allows anonymous clients to create reusable administrator credentials without authentication. The flaw exploits a weakness in FreeIPA's access control rules combined with a secondary vulnerability in 389 Directory Server (CVE-2026-76560), enabling attackers to bypass authentication mechanisms and gain administrative privileges on Linux domain controllers. Red Hat successfully reproduced the attack chain twice on default installations, demonstrating how unauthenticated attackers can inject Kerberos identities and obtain administrator group membership. This vulnerability highlights the growing sophistication of identity-based attacks targeting enterprise authentication infrastructure, particularly as organizations increasingly rely on centralized identity management systems for zero trust architectures and cloud-native environments.
When AI Attacks AI: The 2026 Autonomous Agent Credential Harvesting Campaign
In September 2026, threat actors deployed autonomous AI agent frameworks to conduct large-scale credential harvesting operations, compromising thousands of third-party credentials in under six hours. Google Threat Intelligence Group identified multiple financially motivated groups, including TeamPCP, leveraging AI-assisted tools like DUSTMAKER malware to target AI coding assistants, cloud environments, and supply chains across PyPI, npm, and Docker Hub repositories. The attacks demonstrated unprecedented automation capabilities, with AI systems autonomously managing vulnerability scanning, real-time troubleshooting, and IP rotation without human intervention. This incident represents a critical escalation in AI-enabled cyber threats, coinciding with the rapid adoption of generative AI tools in enterprise environments and the emergence of 'abliterated' open-weight models that bypass safety guardrails.
Liquid Network Suffers $320M Bitcoin Theft Through Elements Software Vulnerability
In September 2026, unknown attackers claiming to be white hat hackers exploited a vulnerability in the Elements software powering Liquid Network's Bitcoin sidechain, withdrawing nearly 4,000 bitcoin worth approximately $320 million. The attackers used a bug in Elements to create unauthorized L-BTC tokens and then executed a peg-out transaction through SideSwap's authorization key, draining 95% of Liquid's bitcoin reserves. After communicating with Blockstream through encrypted messages embedded in Bitcoin transactions, the attackers returned 3,400 bitcoin but retained approximately 598.5 bitcoin worth $47 million. This incident highlights the growing sophistication of cryptocurrency protocol attacks and the blurred lines between legitimate security research and extortion in the DeFi ecosystem, particularly as Bitcoin layer-2 solutions become increasingly targeted by threat actors.
ChatGPT Prompt Injection Flaw Exposed Gmail Data Through Hidden Cross-Account Channels
In September 2026, Check Point Research disclosed a critical vulnerability in OpenAI's ChatGPT that allowed attackers to inject malicious prompts that could silently exfiltrate user data from connected applications like Gmail. The attack exploited a shared internal JFrog Artifactory service used by ChatGPT's isolated containers, creating an unauthorized communication channel between different user accounts. Attackers could plant instructions through shared conversations, custom GPTs, or user-pasted prompts that would execute hidden data theft operations while displaying normal responses to victims. OpenAI confirmed the vulnerability and took the internal service offline after disclosure. This incident highlights the emerging risks of AI systems as attack vectors, particularly as organizations increasingly integrate AI tools with sensitive business applications and data sources, making prompt injection attacks a critical new threat category requiring immediate security attention.
WeChat Zero-Click Worm: How 1.4 Billion Users Were at Risk from Incoming Calls
In July 2026, security researchers at Calif discovered a critical zero-click vulnerability in WeChat that allowed attackers to take complete control of user accounts through incoming calls without any user interaction. The exploit worked by leveraging WeChat's contact trust system, enabling worm-like propagation where compromised accounts could automatically infect other contacts. Affecting WeChat's 1.4 billion user base across iPhone and Android platforms, the vulnerability granted attackers full access to messages, payments, and WeChat's extensive ecosystem of mini-programs and services. Tencent patched the flaw in August 2026 versions 8.0.77 for Android and 8.0.76 for iOS. This incident highlights the growing sophistication of mobile application attacks and the critical importance of securing communication platforms that serve as digital wallets and business ecosystems, particularly as zero-click exploits become increasingly weaponized against high-value messaging applications.
AI Reasoning Traces Theft: The 2026 Vulnerability That Exposed AI's Hidden Thoughts
In 2026, security researchers discovered a critical vulnerability affecting major AI providers including OpenAI, Anthropic, and Google, where encrypted reasoning traces from large language models could be stolen and decoded. The attack exploited the interchangeable nature of encrypted reasoning blocks across different sessions and models, allowing adversaries to inject traces into weaker models to extract proprietary reasoning in plaintext. This vulnerability enabled four distinct attack vectors: circumventing anti-distillation mechanisms, large-scale private data extraction, revealing hidden hazardous information, and executing invisible prompt injections. Researchers successfully extracted 367 PII artifacts and 182 credentials from 315,320 reasoning blocks scraped from public repositories, demonstrating the significant privacy and security implications. This incident highlights the emerging risks in AI security as organizations increasingly deploy autonomous AI agents and rely on cloud-based AI services, making AI-specific vulnerabilities a critical new attack surface that traditional security measures may not adequately address.
July 2024 Water Utility Attacks Expose Critical Infrastructure Blind Spots
In July 2024, over 100 water and wastewater treatment systems across multiple states were compromised through vulnerable industrial controllers connected directly to public cellular networks. CISA identified the widespread campaign targeting Rockwell Allen-Bradley, Schneider Electric, and Siemens equipment, with attackers gaining operational control and causing service disruptions including pump station failures and boil-water advisories. The incidents exposed critical infrastructure gaps where operational technology exists outside traditional IT security boundaries, with many systems invisible to network scans but trackable through carrier invoices. This campaign highlights the urgent need for comprehensive network visibility and microsegmentation in critical infrastructure, as traditional network perimeter defenses fail to protect cellular-connected industrial control systems that operate independently of municipal IT networks.
N-able N-central CVE-2026-86218: When RMM Platforms Become Attack Vectors
N-able released an emergency hotfix for CVE-2026-86218, a maximum-severity remote code execution vulnerability in its N-central remote monitoring and management platform used by IT departments and MSPs. The flaw allows unprivileged attackers to execute malicious code on exposed N-central instances through low-complexity attacks. With nearly 1,500 N-central servers exposed online and evidence of active exploitation flagged by Huntress cybersecurity, the company urged immediate patching to N-central 2026.3 Hotfix 4. This incident highlights the persistent targeting of remote management platforms that provide privileged access to client networks and infrastructure. RMM platforms continue to be attractive targets as they offer attackers potential access to multiple downstream organizations through a single compromise, making them critical components in supply chain attack scenarios.