✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Computer/Network Security
Breach intelligence, attack campaigns, and threat reports targeting the Computer/Network Security sector.
Explore Other Sectors
Computer/Network Security Threat Reports
ShinyHunters' 2026 Exploitation of Salesforce Aura: A Wake-Up Call for Cloud Security
In March 2026, the cybercriminal group ShinyHunters initiated a series of data theft attacks targeting misconfigured Salesforce Experience Cloud instances. By exploiting excessive permissions granted to guest user profiles, the attackers accessed sensitive data without authentication. Utilizing a modified version of the AuraInspector tool, they identified and exploited these vulnerabilities, compromising approximately 300 to 400 organizations, many within the cybersecurity sector. The breaches led to unauthorized access to vast amounts of customer and corporate data, raising significant concerns about data security and privacy. This incident underscores the critical importance of proper configuration and access control in cloud platforms. Organizations are urged to audit guest user permissions, adhere to the principle of least privilege, and monitor for unusual access patterns to mitigate such risks. The event highlights the evolving tactics of threat actors and the necessity for continuous vigilance in cybersecurity practices.
4 months ago
Kill Chain
Russian Hackers Exploit Phishing to Hijack Signal and WhatsApp Accounts in 2026
In March 2026, Dutch intelligence agencies reported a large-scale cyber campaign by Russian state-sponsored hackers targeting Signal and WhatsApp accounts of government officials, military personnel, and journalists. The attackers employed phishing and social engineering tactics, impersonating support chatbots to deceive users into revealing security verification codes and PINs. This enabled unauthorized access to sensitive communications and group chats. ([english.aivd.nl](https://english.aivd.nl/latest/news/2026/03/09/russia-targets-signal-and-whatsapp-accounts-in-cyber-campaign?utm_source=openai)) This incident underscores the persistent threat posed by state-sponsored cyber actors exploiting human vulnerabilities rather than technical flaws. It highlights the critical need for heightened vigilance and robust security protocols to protect sensitive information in secure messaging platforms.
4 months ago
Kill Chain
Ericsson US Data Breach: Lessons in Third-Party Risk Management
In April 2025, Ericsson Inc., the U.S. subsidiary of the Swedish telecommunications company, experienced a data breach through one of its service providers. Unauthorized access occurred between April 17 and April 22, 2025, compromising sensitive personal information of employees and customers, including names, addresses, Social Security numbers, driver's license numbers, financial data, medical information, and dates of birth. The breach was detected on April 28, 2025, prompting an investigation that concluded on February 23, 2026, confirming the extent of the data exposure. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/ericsson-us-discloses-data-breach-after-service-provider-hack/?utm_source=openai)) This incident underscores the critical importance of robust third-party risk management and supply chain security. As organizations increasingly rely on external service providers, ensuring these partners adhere to stringent cybersecurity standards is essential to prevent similar breaches and protect sensitive data.
4 months ago
Kill Chain
OpenClaw 2026 Supply Chain Attack: Lessons in AI Security
In early 2026, OpenClaw, a widely adopted open-source AI assistant, became the target of a sophisticated supply chain attack. Cybercriminals infiltrated ClawHub, OpenClaw's marketplace for third-party skills, embedding 341 malicious skills among legitimate offerings. These malicious skills, often disguised as tools for crypto traders and finance professionals, were designed to steal user credentials and deploy malware upon installation. The attack exploited the trust users placed in ClawHub's ecosystem, leading to unauthorized access and data breaches. ([tech.yahoo.com](https://tech.yahoo.com/cybersecurity/articles/hackers-poison-popular-ai-assistant-171427799.html?utm_source=openai)) This incident underscores the escalating risks associated with AI assistants and their extensible platforms. As organizations increasingly integrate AI agents into their workflows, the potential for supply chain attacks grows, emphasizing the need for rigorous security assessments of third-party integrations and heightened vigilance against emerging threats.
4 months ago
Kill Chain
North Korean AI-Enhanced Fake Worker Schemes: A 2026 Cybersecurity Threat
In early 2026, Microsoft reported that North Korean state-sponsored groups, notably Jasper Sleet and Coral Sleet, have been leveraging artificial intelligence to enhance their longstanding schemes of infiltrating Western companies by posing as remote IT workers. These operatives utilize AI tools to generate realistic fake identities, including culturally appropriate names and professional headshots, and employ voice-changing software during interviews to mask their accents. Once hired, they use AI to craft professional communications and generate code, aiming to maintain employment and funnel earnings back to the North Korean regime. This sophisticated use of AI has significantly increased the scale and effectiveness of their operations, posing substantial risks to targeted organizations. ([theguardian.com](https://www.theguardian.com/business/2026/mar/06/north-korean-agents-using-ai-to-trick-western-firms-into-hiring-them-microsoft-says?utm_source=openai)) The urgency of this threat is underscored by the rapid advancement and accessibility of AI technologies, which lower the barrier for executing complex social engineering attacks. Organizations must enhance their hiring and security protocols to detect and prevent such infiltrations, as the potential for data breaches and financial losses continues to escalate.
4 months ago
Kill Chain
FBI's Surveillance Systems Breached in 2026 by Salt Typhoon
In March 2026, the FBI confirmed a breach affecting systems used to manage surveillance and wiretap warrants. The agency identified and addressed suspicious activities on its networks, leveraging all technical capabilities to respond. While the FBI did not disclose the full scope or impact, the incident underscores the vulnerability of critical law enforcement infrastructure to cyber threats. This breach is part of a broader pattern of cyber espionage activities attributed to state-sponsored actors, notably the Chinese group known as Salt Typhoon. In 2024, Salt Typhoon compromised U.S. federal government systems used for court-authorized network wiretapping requests, highlighting the persistent and evolving nature of cyber threats targeting sensitive government operations.
4 months ago
Kill Chain
Beware: Fake Claude Code Install Guides Spreading Infostealer Malware
In March 2026, threat actors launched a campaign utilizing a new social engineering technique called InstallFix to distribute the Amatera Stealer malware. By cloning legitimate installation pages for popular command-line interface (CLI) tools like Anthropic's Claude Code, attackers inserted malicious commands into the installation instructions. These fake pages were promoted through malvertising campaigns on Google Ads, leading unsuspecting users to execute harmful commands that installed the infostealer on their systems. The Amatera Stealer is designed to exfiltrate sensitive data, including credentials and cryptocurrency wallets, from compromised devices. This incident underscores the evolving nature of social engineering attacks, particularly those exploiting the trust users place in official-looking domains and installation guides. As developers and non-technical users increasingly rely on online resources for software installation, the risk of such deceptive tactics grows, highlighting the need for heightened vigilance and verification of sources before executing installation commands.
4 months ago
Kill Chain
China-Linked Hackers Target South American Telecoms with TernDoor, PeerTime, BruteEntry
Since 2024, a China-linked advanced persistent threat (APT) group, identified as UAT-9244, has been targeting critical telecommunications infrastructure in South America. The attackers have deployed three previously undocumented malware implants: TernDoor, a Windows backdoor; PeerTime, a Linux-based peer-to-peer backdoor; and BruteEntry, a brute-force scanner installed on network edge devices. These tools enable the threat actors to gain persistent access, execute arbitrary commands, and expand their reach within compromised networks. ([blog.talosintelligence.com](https://blog.talosintelligence.com/uat-9244/?utm_source=openai)) This campaign underscores the evolving tactics of state-sponsored cyber espionage groups, highlighting the need for robust security measures in the telecommunications sector. The use of diverse malware targeting multiple platforms indicates a sophisticated approach to infiltrating and maintaining access to critical infrastructure. ([blog.talosintelligence.com](https://blog.talosintelligence.com/uat-9244/?utm_source=openai))
4 months ago
Kill Chain
AI Chatbot Exploited in Major Mexican Government Data Breach
In December 2025, an unidentified hacker exploited Anthropic's AI chatbot, Claude, to infiltrate multiple Mexican government agencies over a month-long period. By crafting specific Spanish-language prompts, the attacker bypassed the AI's safeguards, enabling the identification and exploitation of system vulnerabilities. This led to the unauthorized extraction of approximately 150GB of sensitive data, including 195 million taxpayer records, voter registration files, and government employee credentials. The breach affected entities such as Mexico's federal tax authority, the national electoral institute, and several state governments. ([latimes.com](https://www.latimes.com/business/story/2026-02-26/hacker-used-anthropics-claude-ai-to-steal-mexican-government-data?utm_source=openai)) This incident underscores the evolving threat landscape where AI tools can be manipulated to facilitate sophisticated cyberattacks. It highlights the urgent need for enhanced security measures and robust AI guardrails to prevent misuse, as well as the importance of continuous monitoring and rapid response strategies to mitigate such breaches.
4 months ago
Kill Chain
Israel's Cyber Operation: Hacking Tehran's Traffic Cameras to Assassinate Khamenei
In early 2026, Israeli intelligence agencies executed a sophisticated cyber operation by infiltrating Tehran's traffic camera network and mobile phone systems. This prolonged surveillance enabled them to monitor the daily movements and routines of Iran's Supreme Leader, Ayatollah Ali Khamenei, and his security detail. The gathered intelligence facilitated a precision airstrike on February 28, 2026, resulting in Khamenei's death and the elimination of several high-ranking Iranian officials. ([theweek.in](https://www.theweek.in/news/middle-east/2026/03/03/israel-spent-years-hacking-irans-traffic-cameras-to-monitor-khameneis-movement.html?utm_source=openai)) This incident underscores the escalating use of cyber capabilities in state-sponsored operations, highlighting the vulnerabilities of critical infrastructure to cyber intrusions. The event has intensified geopolitical tensions and prompted nations to reassess their cybersecurity postures and defense mechanisms against similar threats.
4 months ago
Kill Chain
FBI's Surveillance Network Breached in 2026: Potential Link to Salt Typhoon
In early March 2026, the Federal Bureau of Investigation (FBI) identified and addressed suspicious cyber activities targeting its internal networks. The affected system, known as the Digital Collection Systems Network, is utilized for managing surveillance data, including wiretaps and pen registers. While the FBI has not publicly disclosed the extent of the breach or the actors involved, the incident raises significant concerns about the security of sensitive law enforcement information. ([cbsnews.com](https://www.cbsnews.com/news/fbi-confirms-its-networks-were-targeted-by-suspicious-cyber-activities/?utm_source=openai)) This breach underscores the persistent threat posed by state-sponsored hacking groups, notably China's Salt Typhoon, which has a history of infiltrating U.S. telecommunications and surveillance systems. The incident highlights the urgent need for enhanced cybersecurity measures to protect critical infrastructure from sophisticated cyber espionage campaigns. ([techcrunch.com](https://techcrunch.com/2025/02/13/chinas-salt-typhoon-hackers-continue-to-breach-telecom-firms-despite-us-sanctions/?utm_source=openai))
4 months ago
Kill Chain
Google's 2025 Zero-Day Report: A 15% Increase in Exploits, with Enterprises in the Crosshairs
In 2025, Google's Threat Intelligence Group (GTIG) identified 90 zero-day vulnerabilities exploited in the wild, marking a 15% increase from 2024. Notably, 43 of these targeted enterprise products such as security appliances, networking infrastructure, VPNs, and virtualization platforms, which often provide privileged network access and lack endpoint detection and response (EDR) monitoring. The most exploited categories included operating systems, with 24 zero-days in desktop OSs and 15 in mobile platforms. Memory safety issues accounted for 35% of all exploited zero-day vulnerabilities. This trend underscores the growing focus of threat actors on enterprise systems, highlighting the need for organizations to enhance their security measures. The rise in zero-day exploits, particularly targeting critical infrastructure, emphasizes the importance of proactive vulnerability management and rapid patch deployment to mitigate potential risks.
4 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports