✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 3361 to 3372 of 5257
Zendesk 2024 Spam Attacks Expose SaaS Security Gaps
In June 2024, multiple organizations using Zendesk experienced a widespread spam campaign that abused legitimate Zendesk instances to distribute malicious and unwanted emails. Attackers leveraged open or misconfigured support ticketing forms, submitting large volumes of spam through these systems. The CRM vendor Zendesk responded by assuring customers that the event was not tied to any software vulnerability or security breach within the platform itself. Business impact centered on increased phishing risk and operational noise in customer service channels, as well as potential reputational harm to affected brands. This incident highlights a growing trend where attackers abuse trusted SaaS communication channels to bypass traditional email security filters. As threat actors increasingly focus on exploiting third-party platforms and automation, organizations face new challenges securing digital touchpoints against social engineering and spam-based threats.
6 months ago
Kill Chain
Visual Studio Code: The Hidden Supply-Chain Threat Targeting Developers (2024)
In January 2024, a novel supply-chain attack vector targeting Visual Studio Code (VSCode) environments was exposed. Threat actors leveraged VSCode's task automation feature by embedding malicious scripts within project-level '.vscode/tasks.json' files. When an unsuspecting developer opened a compromised repository or project directory, these hidden tasks executed automatically, enabling code execution—potentially leading to malware installation, data exfiltration, or further lateral movement within the developer’s environment. The attack mimics macro-style threats seen in Office documents, utilizing obfuscated scripts and exploiting legitimate productivity features to bypass traditional security controls. This breach highlights the growing exploitation of developer tools as initial intrusion points, particularly given the increased reliance on open-source ecosystems and extensions. Supply-chain attacks via development environments are on the rise, pressuring organizations to improve oversight of internal code, dependencies, and automated scripts. Vigilance around workspace configuration files, especially auto-executing tasks, is now critical for enterprise security posture.
6 months ago
Kill Chain
How an Azure Private Endpoint DNS Misconfiguration Triggered Massive DoS Risks in 2026
In January 2026, security researchers highlighted a critical cloud misconfiguration affecting Microsoft Azure’s Private Endpoint architecture that could trigger denial-of-service (DoS) conditions. Specifically, Azure Private Link’s DNS resolution behavior was shown to inadvertently block access to resources—including Azure Storage, Key Vault, CosmosDB, and others—when Private DNS zones were misconfigured. The risks arise in accidental and malicious deployment scenarios, where incomplete or improper DNS records prevent workloads from connecting, despite the underlying resource being online. This exposure reportedly affects over 5% of Azure storage accounts, posing operational disruption risks through simple configuration errors or targeted attacker activity. This incident underscores the increasing complexity and fragility of cloud-native networking, as organizations accelerate the adoption of zero trust and segmentation patterns. With threat actors and insider mistakes both leveraging subtle service settings, this serves as an urgent reminder that cloud misconfiguration remains a leading cause of outages and breaches.
6 months ago
Kill Chain
Google Gemini AI Breach: Prompt Injection Attack Exposes Enterprise Calendar Data
In January 2026, researchers at Miggo Security demonstrated a semantic prompt injection attack against Google Gemini, the company’s flagship AI assistant integrated across Google Workspace. By sending a maliciously crafted Calendar invitation containing natural-language instructions in the event’s description, attackers could leverage Gemini’s automated parsing and task execution to exfiltrate sensitive calendar data. When a victim queried Gemini about their schedule, the model would follow the embedded instructions, summarize all meetings—including private ones—and leak the information by generating a new event visible to the attacker. This bypassed existing filtering mechanisms and exposed data without explicit user approval. The incident underscores the rising concern over generative AI systems’ susceptibility to context-driven prompt injection and logic abuse. It highlights an urgent need for context-aware and semantic-level defenses in AI-integrated business applications, as AI assistants become deeply embedded in productivity suites throughout the enterprise sector.
6 months ago
Kill Chain
VoidLink Malware: How AI Accelerated a New Breed of Cloud Attacks
In late November 2025, researchers identified the VoidLink malware framework targeting Linux-based cloud servers. Distinct for its use of AI-driven development, VoidLink was built by a single operator primarily using the TRAE SOLO AI assistant, leading to an advanced, feature-rich malware toolkit in under a week. The incident became public after the attacker inadvertently exposed critical code, documentation, and sprint plans via an unsecured open directory, allowing security analysts to trace the rapid, AI-assisted development timeline and examine the malware’s architecture, which included custom loaders, implants, and rootkit modules for stealth and evasive operations. VoidLink represents the first extensively documented case of a sophisticated threat being produced predominately through AI modeling and automation. Its rapid development cycle and advanced modularity demonstrate the growing capability for individuals or small groups to deploy complex attacks once reserved for well-resourced threat actors—an evolution that underscores urgent challenges for enterprise security teams and the mitigation of future AI-driven threats.
6 months ago
Kill Chain
Critical 2026 WordPress ACF Extended Vulnerability Exposes 50,000 Sites to Admin Takeover
In January 2026, a critical privilege escalation vulnerability (CVE-2025-14533) was discovered in the ACF Extended plugin for WordPress, which is active on over 100,000 sites. The flaw enables unauthenticated, remote attackers to create or update user accounts with arbitrary roles, including administrator, by abusing weak form restrictions in plugin versions 0.9.2.1 and earlier. Although the vulnerability requires sites to use specific forms with a role field, compromise enables full site takeover and administrative control. The issue was responsibly disclosed in December 2025 and patched four days later, but nearly half of the installed base reportedly remained exposed at the time of reporting. This incident accentuates the persistent risk posed by third-party plugin vulnerabilities in WordPress ecosystems and the widespread targeting of such platforms by malicious actors. With large-scale enumeration and exploitation of plugin flaws on the rise, organizations should prioritize rapid patching and robust privilege segmentation to reduce their exposure.
6 months ago
Kill Chain
Evelyn Stealer Exposes Developer Credential Risks in VS Code Supply Chain
In January 2026, researchers uncovered a malware campaign exploiting the Microsoft VS Code extension ecosystem to deliver Evelyn Stealer, an infostealer targeting software developers. Threat actors distributed malicious extensions which downloaded and executed a secondary payload, ultimately injecting the stealer into a legitimate process. Once executed, the malware harvested sensitive information—including developer credentials, stored cookies, crypto wallets, and system data—then exfiltrated these assets via FTP to a remote server. Attackers also deployed anti-analysis and evasion techniques, enabling seamless and covert data theft that potentially compromised broader organizational systems by abusing developer environments as entry points. This attack underscores the growing risks to the software supply chain, as developer tools become lucrative vectors for credential and asset theft. The Evelyn Stealer incident reflects an expanding trend where infostealers leverage trusted development ecosystems, highlighting the urgent need for stronger security controls and supply chain hygiene in rapidly evolving threat landscapes.
6 months ago
Kill Chain
2026 JavaScript Secrets Leak: Tens of Thousands of API Tokens Exposed in Production Web App Bundles
In January 2026, a sweeping automated analysis uncovered the exposure of over 42,000 sensitive API tokens—including GitHub, GitLab, Slack, Linear, and other SaaS access keys—in JavaScript bundles of live, internet-facing web applications. The research, conducted at massive scale across 5 million applications, revealed that traditional infrastructure and application security scanners consistently missed these secrets, leaving organizations exposed to repository breaches, data leaks, and system compromise. Critical tokens found enabled attackers to access private code, internal projects, downstream services, and business-critical data, demonstrating broad gaps in application supply chain controls. This incident highlights persistent shortcomings in secrets detection across the application lifecycle. As businesses accelerate cloud adoption, CI/CD automation, and shift-left security, the failure of both automated scanners and static analysis to catch secrets in deployed JavaScript highlights urgent challenges. The trend will likely intensify with rising use of contemporary development pipelines and AI-generated code.
6 months ago
Kill Chain
Cloudflare ACME WAF Bypass: How a 2026 Edge Vulnerability Left Origins Exposed
In January 2026, Cloudflare disclosed and remediated a critical vulnerability in its ACME (Automatic Certificate Management Environment) HTTP-01 validation process. The flaw allowed attackers to craft requests that bypassed Cloudflare's Web Application Firewall (WAF), gaining unauthorized access to protected origin servers by exploiting the path handling for ACME challenges. There is no evidence of mass exploitation, but the vulnerability exposed the underlying infrastructure to potential attacks until it was patched. Cloudflare identified, investigated, and quickly deployed a fix to mitigate further risk to its global customer base. The incident highlights the ongoing importance of robust validation logic and continuous testing in security edge infrastructure. As attackers adapt to complex cloud architectures, bypass techniques targeting certificate management or internal authentication flows are increasingly relevant for organizations using shared security platforms.
6 months ago
Kill Chain
Tudou Guarantee Shuts Down Telegram Transactions After $12B Crypto Fraud Wave
In January 2026, Tudou Guarantee Marketplace, a major Telegram-based platform known for facilitating illicit services and cryptocurrency fraud, halted its public Telegram transactions after processing over $12 billion in suspicious activity. This dramatic step followed the arrest of Chen Zhi, CEO of Prince Group, whose organization was linked to large-scale scam operations including forced labor, romance scams, and investment fraud. The sudden drop in wallet activity suggests a direct link to recent law enforcement action targeting Southeast Asian scam networks. This incident highlights the persistent risks of unregulated messaging platforms in enabling transnational cybercrime and the growing technological sophistication behind crypto-related fraud. With law enforcement crackdowns intensifying and marketplaces shifting tactics, organizations must update controls against social engineering, identity abuse, and crypto laundering.
6 months ago
Kill Chain
Exposing the Hidden Threat: Orphan Accounts and the Identity Dark Matter (2026)
In January 2026, the cybersecurity community highlighted mounting risks associated with orphaned accounts—dormant but still-active identities left behind after employee turnover, organizational change, or fragmented onboarding processes. Attackers have repeatedly leveraged these unattended, often highly privileged accounts as entry points, as seen in notable breaches such as Colonial Pipeline (2021) and a 2025 ransomware attack on a manufacturing firm. These accounts evade detection and deprovisioning, undermining traditional Identity and Access Management (IAM) controls and enabling credential-based attacks that can lead to regulatory violations, operational inefficiencies, and delayed incident response. Such orphaned identities are a growing concern amid expanding use of non-human and AI-driven service accounts, especially following M&A activity. Their proliferation reflects a macro trend in attacker tactics: exploiting visibility and lifecycle gaps in identity governance—putting critical compliance frameworks and business continuity at risk.
6 months ago
Kill Chain
LinkedIn Phishing Campaign Delivers RAT via DLL Sideloading—2026 Incident Analysis
In January 2026, security researchers identified a sophisticated phishing campaign exploiting LinkedIn direct messages to deliver weaponized WinRAR self-extracting archives targeting high-value individuals. Attackers used social engineering to establish trust, convincing victims to download an archive containing a legitimate open-source PDF reader, a malicious DLL, the Python interpreter, and a decoy file. Upon execution, the PDF reader sideloaded the malicious DLL, which deployed the Python interpreter, created persistence via a Registry Run key, and executed Base64-encoded shellcode in memory. This led to covert remote access, data exfiltration, and enabled attackers to move laterally across networks. The incident underscores a broader trend of attackers abusing social media platforms for initial access, bypassing traditional email-centric defenses, and leveraging open-source tools with advanced evasion techniques like DLL sideloading. As social engineering campaigns diversify across communication channels, all business sectors face amplified risks of stealthy malware delivery and long-term compromise.
6 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Attackers Learned to Use AI. Now They Built Tools to Destroy It.
Living-off-the-Agent: How AI Tool Misuse Became the Insider Threat Nobody Provisioned
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
