✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 1453 to 1464 of 5110
Storm-2949's Exploitation of SSPR in Microsoft 365 and Azure Breach
In May 2026, the threat actor known as Storm-2949 executed a sophisticated attack targeting Microsoft 365 and Azure environments. Utilizing social engineering tactics, they impersonated IT support to exploit the Self-Service Password Reset (SSPR) feature, gaining unauthorized access to privileged accounts. This access enabled them to exfiltrate sensitive data from OneDrive, SharePoint, and Azure resources, including virtual machines, storage accounts, key vaults, app services, and SQL databases. The attackers leveraged legitimate administrative tools to blend into normal operations, complicating detection efforts. This incident underscores the evolving threat landscape where attackers increasingly exploit identity management systems and cloud services. Organizations must enhance their security protocols, particularly around identity verification and access controls, to mitigate such sophisticated attacks.
2 months ago
Kill Chain
Microsoft Disrupts Fox Tempest: A Cybercrime Service Exploiting Trusted Platforms
In May 2026, Microsoft disrupted a cybercrime operation known as Fox Tempest, which had been abusing Microsoft's Artifact Signing service to generate fraudulent code-signing certificates. These certificates allowed malware to be digitally signed, making it appear as legitimate software to users and operating systems. Fox Tempest created over a thousand certificates and established hundreds of Azure tenants and subscriptions to support its operations. The service was linked to various malware and ransomware campaigns, including those involving Oyster, Lumma Stealer, Vidar, and ransomware families such as Rhysida, Akira, INC, Qilin, and BlackByte. Microsoft seized the domain signspace[.]cloud, took hundreds of virtual machines offline, and blocked access to the infrastructure hosting the cybercrime platform. This action underscores the evolving tactics of cybercriminals who exploit trusted platforms to distribute malware, highlighting the need for continuous vigilance and adaptive security measures.
2 months ago
Kill Chain
Critical ChromaDB Vulnerability (CVE-2026-45829) Exposes AI Servers to Remote Code Execution
In May 2026, a critical vulnerability identified as CVE-2026-45829 was discovered in ChromaDB's Python FastAPI server, affecting versions 1.0.0 and later. This flaw allows unauthenticated attackers to execute arbitrary code on exposed servers by sending crafted requests that exploit the server's handling of model repositories. The vulnerability arises from improper authentication checks, enabling attackers to load and execute malicious models from external sources like Hugging Face before any authentication is performed. This can lead to full server compromise, data exfiltration, and disruption of AI/ML workflows. The incident underscores the growing risks associated with AI infrastructure vulnerabilities, especially as AI applications become more integrated into critical business operations. Organizations must prioritize securing their AI systems by implementing robust authentication mechanisms, conducting regular security audits, and staying vigilant against emerging threats targeting AI platforms.
2 months ago
Kill Chain
Unveiling Trapdoor: The 2026 Android Ad Fraud Scheme
In May 2026, cybersecurity researchers uncovered 'Trapdoor,' a sophisticated ad fraud and malvertising operation targeting Android users. The scheme involved 455 malicious apps and 183 command-and-control domains, creating a self-sustaining cycle of fraud. Users unknowingly downloaded utility-style apps, which then initiated malvertising campaigns, coercing them into installing additional malicious apps. These secondary apps launched hidden WebViews, loaded threat actor-controlled HTML5 domains, and requested ads, leading to 659 million daily bid requests and over 24 million app downloads, primarily affecting users in the U.S. ([thehackernews.com](https://thehackernews.com/2026/05/trapdoor-android-ad-fraud-scheme-hit.html?utm_source=openai)) This incident highlights the evolving tactics of cybercriminals who blend legitimate tools with malicious intent, emphasizing the need for continuous vigilance and advanced detection mechanisms to protect users from such deceptive schemes.
2 months ago
Kill Chain
Preventing Unauthorized AWS Account Removals: Insights from AWS CIRT
In May 2026, the AWS Customer Incident Response Team (CIRT) identified a tactic where threat actors, upon gaining control of a customer's AWS account, remove it from the AWS Organizations structure. This action bypasses Service Control Policies (SCPs) and other governance controls, leading to potential security risks and loss of centralized management. The attackers exploit permissions like `organizations:LeaveOrganization` to execute this maneuver, resulting in the account operating independently without the protective measures enforced by the organization. This incident underscores the importance of implementing strict IAM policies and SCPs to prevent unauthorized account removals. Organizations should regularly audit permissions, enforce the principle of least privilege, and monitor CloudTrail logs for `organizations:LeaveOrganization` API calls to detect and mitigate such threats promptly.
2 months ago
Kill Chain
AI-Driven Vulnerability Discovery: Transforming Cybersecurity in 2026
In April 2026, Anthropic's AI model, Mythos, identified thousands of previously unknown vulnerabilities across major operating systems and web browsers, including a 27-year-old flaw in OpenBSD. This unprecedented discovery underscores the transformative impact of AI in cybersecurity, enabling rapid identification of critical vulnerabilities that had remained undetected for decades. ([ibm.com](https://www.ibm.com/think/insights/the-mythos-moment-when-discovery-outpaces-defense?utm_source=openai)) The rapid pace of AI-driven vulnerability discovery has compressed the timeline between identification and potential exploitation, necessitating immediate and robust defensive measures. Organizations must adapt to this accelerated threat landscape by integrating AI-powered tools into their security protocols to effectively manage and mitigate emerging risks. ([sans.org](https://www.sans.org/press/announcements/emergency-strategy-briefing-ai-driven-vulnerability-discovery-compresses-exploit-timelines?utm_source=openai))
2 months ago
Kill Chain
CISA Contractor's GitHub Repository Exposes Sensitive AWS Credentials
In May 2026, a contractor for the Cybersecurity & Infrastructure Security Agency (CISA) inadvertently exposed highly sensitive credentials by maintaining a public GitHub repository named "Private-CISA." This repository contained administrative credentials for three AWS GovCloud accounts, plaintext passwords for numerous internal CISA systems, and detailed internal documentation on software development processes. The exposure persisted for approximately six months before being discovered by a security researcher from GitGuardian, who alerted CISA. The repository was subsequently taken offline, and an investigation was initiated to assess potential impacts. This incident underscores the critical importance of stringent security practices in managing sensitive information, especially within organizations tasked with national cybersecurity. It highlights the risks associated with improper handling of credentials and the necessity for robust oversight and compliance measures to prevent similar exposures in the future.
2 months ago
Kill Chain
Claw Chain Vulnerabilities: A Wake-Up Call for AI Agent Security
In April 2026, security researchers identified four critical vulnerabilities in the OpenClaw AI agent framework, collectively termed 'Claw Chain.' These flaws—CVE-2026-44112, CVE-2026-44113, CVE-2026-44115, and CVE-2026-44118—allowed attackers to exploit race conditions and logic errors to gain unauthorized access, escalate privileges, and establish persistent control over affected systems. The vulnerabilities impacted all OpenClaw versions prior to 2026.4.22, enabling adversaries to manipulate system configurations, exfiltrate sensitive data, and bypass sandbox restrictions. The discovery of 'Claw Chain' underscores the escalating security challenges associated with rapidly adopted AI agent platforms. As organizations increasingly integrate such frameworks into critical workflows, the potential attack surface expands, necessitating vigilant security assessments and prompt patch management to mitigate emerging threats.
2 months ago
Kill Chain
Critical Microsoft Exchange Zero-Day CVE-2026-42897 Exploited in the Wild
In May 2026, Microsoft disclosed a zero-day vulnerability, CVE-2026-42897, affecting on-premises versions of Exchange Server 2016, 2019, and Subscription Edition. This cross-site scripting (XSS) flaw allows attackers to execute arbitrary JavaScript in a user's browser by sending a specially crafted email, which, when opened in Outlook Web Access (OWA), triggers the exploit. The vulnerability has been actively exploited in the wild, leading to potential unauthorized access to users' mailboxes and session tokens. Microsoft has provided temporary mitigations through the Exchange Emergency Mitigation Service (EEMS) and manual scripts, but a permanent patch is still pending. ([notebookcheck.net](https://www.notebookcheck.net/Microsoft-Exchange-Server-zero-day-exploited-via-crafted-email.1298885.0.html?utm_source=openai)) The exploitation of CVE-2026-42897 underscores the persistent threat posed by XSS vulnerabilities, even in widely used enterprise applications. Organizations relying on on-premises Exchange Servers must remain vigilant, apply available mitigations promptly, and monitor for any signs of compromise to protect sensitive information and maintain operational integrity.
2 months ago
Kill Chain
Mini Shai-Hulud Attack Compromises AntV npm Packages in 2026
In May 2026, the 'Mini Shai-Hulud' supply chain attack compromised over 300 npm packages within the @antv ecosystem by exploiting a maintainer's account. The attackers published 639 malicious versions across 323 packages, embedding malware designed to steal developer credentials and cloud secrets. This breach affected widely used packages like echarts-for-react, impacting millions of weekly downloads. This incident underscores the escalating threat of supply chain attacks targeting open-source ecosystems. The rapid propagation and sophisticated techniques employed highlight the need for enhanced security measures in package management and developer workflows to prevent similar future compromises.
2 months ago
Kill Chain
GitHub Actions Supply Chain Attack Highlights CI/CD Security Vulnerabilities
In May 2026, threat actors compromised the GitHub Actions workflow 'actions-cool/issues-helper' by redirecting existing tags to an imposter commit containing malicious code. This code, when executed within CI/CD pipelines, harvested sensitive credentials and exfiltrated them to an attacker-controlled server. The attack involved downloading the Bun JavaScript runtime, reading memory from the Runner.Worker process to extract credentials, and transmitting the stolen data to 't.m-kosche[.]com'. GitHub has since disabled access to the affected repository due to violations of its terms of service. This incident underscores the escalating trend of software supply chain attacks targeting CI/CD pipelines. The use of imposter commits to inject malicious code highlights the need for organizations to implement stringent security measures, such as pinning dependencies to known-good commit SHAs and continuously monitoring for unauthorized changes in their development workflows.
2 months ago
Kill Chain
Nx Console Extension Compromised: A Wake-Up Call for Developer Security
On May 18, 2026, a compromised version of the Nx Console extension (version 18.95.0) was published to the Microsoft Visual Studio Code Marketplace. This extension, widely used by over 2.2 million developers, was altered to include a credential-stealing payload. Upon opening any workspace, the malicious extension fetched and executed an obfuscated payload from a hidden commit within the official nrwl/nx GitHub repository. This payload harvested sensitive information, including tokens and secrets from platforms such as GitHub, npm, AWS, HashiCorp Vault, Kubernetes, and 1Password, exfiltrating them via multiple channels. ([stepsecurity.io](https://www.stepsecurity.io/blog/nx-console-vs-code-extension-compromised?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting developer tools. The sophisticated method of embedding malicious code within trusted extensions highlights the need for enhanced vigilance and security measures in software development environments. Developers and organizations must prioritize the integrity of their toolchains to prevent similar breaches.
2 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Attackers Learned to Use AI. Now They Built Tools to Destroy It.
Living-off-the-Agent: How AI Tool Misuse Became the Insider Threat Nobody Provisioned
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
