Computer/Network Security
Breach intelligence, attack campaigns, and threat reports targeting the Computer/Network Security sector.
Explore Other Sectors
Computer/Network Security Threat Reports
RedHook Android Malware Exploits Wireless ADB for Unauthorized Access
In July 2026, cybersecurity researchers identified a new variant of the RedHook Android malware that exploits the Wireless Android Debug Bridge (ADB) feature to gain shell-level access without a computer connection. By deceiving users into granting Accessibility permissions, RedHook enables Developer Options and activates Wireless Debugging, allowing it to connect to the device's ADB service via the loopback interface. This grants the malware elevated privileges, enabling it to stream screens, intercept keystrokes, automate UI interactions, and steal credentials. The attack does not require device rooting, making it effective across all Android devices where users approve the Accessibility Service request. This incident underscores the evolving sophistication of mobile malware, highlighting the need for heightened vigilance among Android users. The exploitation of legitimate features like Wireless ADB for malicious purposes reflects a broader trend of attackers leveraging built-in functionalities to bypass security measures, emphasizing the importance of cautious permission granting and regular security updates.
2 months ago
Kill Chain
Hackers Weaponize Balochistan Police Portal in Multi-Group Espionage Campaigns
Between February 2024 and April 2026, cybersecurity researchers identified sustained cyber espionage activities targeting Pakistani law enforcement agencies, notably the Balochistan Police. These campaigns, attributed to threat actors linked to China and India, involved the compromise of servers hosting sensitive web applications managing police and citizen data. The attackers employed sophisticated techniques, including multi-stage malware deployment and exploitation of unpatched vulnerabilities, to infiltrate and maintain persistent access to these critical systems. The breaches resulted in unauthorized access to confidential information, posing significant risks to national security and public safety. This incident underscores a growing trend of state-sponsored cyber espionage targeting law enforcement and government institutions in South Asia. The convergence of multiple nation-state actors focusing on similar targets highlights the strategic importance of such entities and the escalating cyber threats they face. Organizations must enhance their cybersecurity posture to defend against increasingly sophisticated and persistent adversaries.
2 months ago
Kill Chain
Ghostcommit: Unveiling the AI Code Review Exploit via Image-Based Prompt Injection
In July 2026, researchers from the University of Missouri-Kansas City's ASSET Research Group unveiled 'Ghostcommit,' a sophisticated supply chain attack that exploits AI code reviewers by embedding prompt injections within image files. The attack involves submitting a pull request containing a PNG image with hidden instructions that, when processed by AI agents, extract sensitive information from the repository's environment files and encode them into the source code as innocuous-looking data. This method effectively bypasses traditional code review processes, as images are typically not scrutinized for malicious content. The 'Ghostcommit' attack underscores a critical vulnerability in AI-assisted development workflows, highlighting the need for enhanced scrutiny of non-textual assets in code reviews. As AI integration in software development continues to grow, understanding and mitigating such novel attack vectors becomes imperative to maintain the integrity and security of development pipelines.
2 months ago
Kill Chain
Wireshark 4.6.7: Critical Security Updates Released
On July 8, 2026, Wireshark released version 4.6.7, addressing twelve security vulnerabilities across various protocol dissectors and file parsers. These flaws, present in versions 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16, could allow attackers to crash the application or consume excessive CPU resources by injecting malformed packets or convincing users to open crafted packet trace files. Affected components include Catapult DCT2000, SSH, IEEE 802.11, Z39.50, UMTS FP, pcapng file reader, and DBS Etherwatch file parser. ([wireshark.org](https://www.wireshark.org/news/20260708.html?utm_source=openai)) This release underscores the importance of promptly updating network analysis tools to mitigate potential security risks. The vulnerabilities highlight the need for continuous vigilance in monitoring and updating software to protect against emerging threats.
2 months ago
Kill Chain
CISA Credential Leak May 2026: A Comprehensive Analysis
In May 2026, the Cybersecurity and Infrastructure Security Agency (CISA) discovered that a contractor had inadvertently exposed privileged Amazon AWS GovCloud keys by uploading them to a public GitHub repository. Upon detection, CISA promptly took the repository and its associated development environment offline, revoked the contractor's access, and conducted a thorough analysis. The investigation confirmed that the leaked credentials had not been misused outside of CISA, and no customer or mission-critical data was compromised. This incident underscores the critical importance of stringent access controls and vigilant monitoring of code repositories to prevent unauthorized exposure of sensitive information. The CISA credential leak highlights the growing risks associated with cloud misconfigurations and the inadvertent exposure of sensitive credentials in public repositories. As organizations increasingly rely on cloud services and collaborative development platforms, it is imperative to implement robust security measures, including regular audits, comprehensive logging, and adherence to zero-trust principles, to mitigate potential threats and safeguard critical assets.
2 months ago
Kill Chain
Insider Threats: Cybersecurity Experts Turned Cybercriminals
In 2023, three U.S. cybersecurity professionals—Ryan Goldberg, Kevin Martin, and Angelo Martino—exploited their insider knowledge to conduct ransomware attacks using the ALPHV/BlackCat variant. Operating between April and December, they targeted multiple organizations, including a medical device company, a pharmaceutical firm, and a drone manufacturer. The trio encrypted victims' data and demanded substantial cryptocurrency ransoms, successfully extorting approximately $1.2 million from one victim. Their actions culminated in guilty pleas and subsequent prison sentences of four years each. ([justice.gov](https://www.justice.gov/opa/pr/two-americans-who-attacked-multiple-us-victims-using-alphv-blackcat-ransomware-sentenced?utm_source=openai)) This case underscores a disturbing trend where trusted insiders leverage their positions for malicious gain, highlighting the critical need for robust internal security measures and continuous monitoring to detect and prevent such insider threats.
2 months ago
Kill Chain
Critical U-Boot Vulnerabilities Expose Devices to Crashes and Code Execution
In July 2026, firmware security firm Binarly disclosed six vulnerabilities in U-Boot, a widely used bootloader for devices such as home routers, smart cameras, and data-center servers. Four of these flaws can cause device crashes, while the remaining two allow attackers to execute arbitrary code during the boot process by presenting malicious images. These vulnerabilities have existed since U-Boot version 2013.07 and affect numerous vendor firmware built upon U-Boot. Exploitation requires delivering a crafted image to the boot path, potentially through physical access or a privileged foothold. The discovery underscores the critical importance of securing bootloaders, as vulnerabilities at this level can compromise the entire system's integrity. Organizations utilizing U-Boot should prioritize applying patches and reviewing their firmware update processes to mitigate potential exploitation risks.
2 months ago
Kill Chain
Injective Labs GitHub Compromise Exposes Supply Chain Vulnerabilities
In July 2026, threat actors compromised the GitHub repository of Injective Labs' SDK project, leading to the publication of a malicious npm package, @injectivelabs/sdk-ts@1.20.21. This package contained code designed to exfiltrate cryptocurrency wallet private keys and mnemonic seed phrases by embedding fake telemetry functionality. The malicious version was released on July 8, 2026, and remained available for download until its deprecation. The attackers utilized a developer's GitHub account with a history of contributions to introduce the malicious code, which was then propagated across 17 additional @injectivelabs scoped packages, affecting numerous downstream users. This incident underscores the escalating threat of supply chain attacks targeting open-source repositories. The sophisticated nature of the attack, involving legitimate contributor accounts and widespread package dependencies, highlights the urgent need for enhanced security measures in software development pipelines to prevent similar breaches.
2 months ago
Kill Chain
Protect Your Crypto Assets: Understanding the 'Ill Bloom' Vulnerability
In July 2026, blockchain security firm Coinspect disclosed a critical vulnerability named 'Ill Bloom' affecting cryptocurrency wallets across multiple blockchains, including Bitcoin, Ethereum, Polygon, Rootstock, Tron, and Solana. The flaw stems from weak randomness in the generation of recovery phrases in certain software wallets, particularly lesser-known mobile applications created as early as 2018. This vulnerability has led to unauthorized access and the draining of funds, with at least $5 million stolen since May 27, 2026, including $3.1 million from 431 wallets in a coordinated attack on that date. ([crypto-economy.com](https://crypto-economy.com/coinspect-flags-ill-bloom-vulnerability/?utm_source=openai)) The 'Ill Bloom' incident underscores the critical importance of secure cryptographic practices in wallet generation. It highlights the ongoing risks associated with software wallets that may not adhere to robust security standards, emphasizing the need for users to verify the security of their wallet applications and consider using hardware wallets or reputable software wallets with strong security measures to safeguard their digital assets.
2 months ago
Kill Chain
Cybersecurity Professional Sentenced for Aiding Ransomware Attacks
In July 2026, Angelo Martino, a 41-year-old former ransomware negotiator from Florida, was sentenced to 70 months in prison for conspiring with the BlackCat ransomware group. Between April and November 2023, Martino exploited his position by leaking confidential information from five U.S. companies he was hired to protect, including cyber insurance limits and internal negotiation strategies. This betrayal enabled BlackCat to extort over $75 million from victims, including a nonprofit ($26.8M) and a financial firm ($25.6M). Additionally, Martino directly assisted in deploying ransomware attacks, demanding over $16 million and personally laundering $1.2 million in Bitcoin. Authorities seized more than $10 million in assets from him, including cryptocurrency, vehicles, and property. ([tomshardware.com](https://www.tomshardware.com/tech-industry/cyber-security/florida-man-pleads-guilty-after-leaking-victims-insurance-details-to-blackcat-hackers?utm_source=openai)) This case underscores the critical importance of trust and integrity within the cybersecurity industry. The exploitation of insider knowledge for malicious purposes highlights the need for stringent vetting processes and continuous monitoring of individuals in sensitive roles. Organizations must remain vigilant against both external threats and potential internal vulnerabilities to safeguard their operations and data.
2 months ago
Kill Chain
Unpatchable Vulnerability in Tangem Wallets Exposed by Laser Attack
In July 2026, Ledger's Donjon security team disclosed a vulnerability in Tangem crypto wallet cards, revealing that a precisely timed laser pulse aimed at the card's secure element chip can reset the card's password without the original password or backup card. This allows an attacker to gain control over the wallet and transfer funds. The attack requires physical possession of the card, specialized equipment estimated at $250,000, and leaves visible damage, making it impractical for widespread exploitation. However, due to Tangem's design, which lacks firmware update capabilities, this vulnerability cannot be patched, leaving all existing cards susceptible. This incident underscores the challenges in securing hardware wallets against sophisticated physical attacks and highlights the importance of considering firmware update mechanisms in device design. While the attack's complexity limits its immediate threat, it raises concerns about the long-term security of devices that cannot receive updates to address discovered vulnerabilities.
2 months ago
Kill Chain
OpenClaw AI Assistant Vulnerabilities: A Wake-Up Call for AI Security
In early 2026, multiple critical vulnerabilities were discovered in OpenClaw, a popular open-source AI assistant. These flaws, including CVE-2026-25253, CVE-2026-24763, and CVE-2026-25157, allowed attackers to execute arbitrary code, escalate privileges, and exfiltrate sensitive data. Exploitation of these vulnerabilities led to unauthorized access to over 28,000 systems worldwide, with attackers gaining full control over affected hosts. The widespread deployment of OpenClaw in enterprise environments amplified the impact, exposing numerous organizations to significant security risks. The rapid adoption of AI agents like OpenClaw underscores the urgent need for robust security measures in AI deployments. This incident highlights the importance of comprehensive vulnerability assessments, timely patch management, and stringent access controls to mitigate the risks associated with integrating AI assistants into critical systems.
2 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports