Computer/Network Security
Breach intelligence, attack campaigns, and threat reports targeting the Computer/Network Security sector.
Explore Other Sectors
Computer/Network Security Threat Reports
FortiBleed Credential Theft Campaign Exposes Over 73,000 Fortinet Devices
In July 2026, the 'FortiBleed' campaign was uncovered, revealing a massive credential theft operation targeting over 73,000 Fortinet devices. Attackers utilized a custom tool named 'FortiGate Sniffer' to intercept VPN credentials directly from network traffic. Subsequent investigations linked this operation to the INC and Lynx ransomware groups, indicating that the stolen credentials were intended to facilitate future network intrusions. This incident underscores the evolving tactics of ransomware groups, highlighting their focus on exploiting network infrastructure vulnerabilities to gain unauthorized access. Organizations must prioritize securing their network devices and monitoring for unusual activities to mitigate such threats.
2 months ago
Kill Chain
ChocoPoC Malware: A New Threat Targeting Cybersecurity Researchers
In July 2026, cybersecurity researchers identified a campaign distributing a Python-based remote access trojan (RAT) named ChocoPoC through trojanized proof-of-concept (PoC) exploits on GitHub. Unlike previous incidents where malware was embedded directly in exploit files, this campaign introduced malicious Python packages into the PoC's dependency list. When victims cloned these repositories, a trojanized package named 'frint' was automatically installed, which subsequently fetched another malicious package, 'skytext.' This package contained a compiled Python extension that decrypted and executed additional code, ultimately downloading the ChocoPoC RAT from a Mapbox dataset. The RAT possessed capabilities such as executing arbitrary commands, uploading files, and collecting sensitive data, including browser credentials and network configurations. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-chocopoc-malware-targets-researchers-via-trojanized-poc-exploits/?utm_source=openai)) This incident underscores a growing trend where threat actors exploit trusted platforms like GitHub to distribute malware, targeting professionals who frequently utilize PoC exploits for research and testing. The sophisticated method of embedding malicious code within dependency packages highlights the need for heightened vigilance when sourcing code from public repositories. As attackers continue to refine their techniques, the cybersecurity community must adapt by implementing stricter code verification processes and promoting awareness about the risks associated with unverified code. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-chocopoc-malware-targets-researchers-via-trojanized-poc-exploits/?utm_source=openai))
2 months ago
Kill Chain
Iran-Nexus TAG-182 Deploys MarkiRAT Malware in Surveillance Campaign
In early 2026, the Iranian-linked threat group TAG-182 initiated a cyber espionage campaign deploying MarkiRAT malware via counterfeit Android applications, including fake VPNs and media tools, to surveil Iranian citizens domestically and abroad. This operation aligns with Iran's intensified digital surveillance efforts following the partial restoration of internet access on May 26, 2026, targeting perceived dissidents and foreign collaborators. The MarkiRAT samples exhibit tradecraft overlaps with previous variants used by Ferocious Kitten, suggesting a potential operational connection, though further evidence is required to confirm organizational links. ([staging.hawk-eye.io](https://staging.hawk-eye.io/iran-apt-threat-advisory/?utm_source=openai)) The resurgence of TAG-182's activities underscores the persistent threat posed by Iranian state-sponsored cyber operations, particularly in the realm of surveillance and intelligence gathering. Organizations and individuals, especially those involved in human rights advocacy or opposition activities, should remain vigilant against sophisticated social engineering tactics and ensure robust cybersecurity measures are in place to mitigate the risks associated with such targeted campaigns.
2 months ago
Kill Chain
Securing AI Endpoints: Lessons from Recent Exploits
Between March and May 2026, Zenity researchers identified three distinct campaigns where threat actors exploited exposed AI inference endpoints, such as those of Ollama and LiteLLM, to conduct offensive operations. These attacks did not require full system compromises; attackers merely needed knowledge of the exposed endpoints to leverage them for activities like autonomous penetration testing and web reverse-engineering. The incidents underscore the critical need for securing AI infrastructure against unauthorized access. This trend highlights a growing tactic among cyber adversaries: exploiting misconfigured or exposed AI endpoints to amplify their offensive capabilities. As organizations increasingly integrate AI into their operations, ensuring the security of these systems becomes paramount to prevent their misuse in cyberattacks.
2 months ago
Kill Chain
BioShocking Attack: A New Threat to AI Browser Security
In June 2026, researchers at LayerX identified a novel prompt injection attack named 'BioShocking' targeting AI-powered browsers. The attack involves a malicious webpage presenting a BioShock-themed puzzle game that rewards incorrect answers, conditioning the browser's control agent to disregard standard safety protocols. In the final stage, the agent is directed to access a GitHub repository and extract sensitive data, such as passwords. This proof-of-concept was tested against six mainstream agentic browsers, with only OpenAI's ChatGPT Atlas implementing an effective fix after disclosure. The BioShocking attack underscores the critical need for robust security measures in AI-driven applications. As AI agents become more integrated into daily tasks, their susceptibility to manipulation poses significant risks. This incident highlights the urgency for developers to implement explicit user confirmations for sensitive actions, enhance context checks, and establish strict boundaries for agentic sessions to prevent similar exploits.
2 months ago
Kill Chain
RustDuck Botnet's Evolution: A New Era of DDoS Threats
Since February 2026, the RustDuck botnet has been actively compromising home routers, IP cameras, Android devices, and poorly secured servers to orchestrate large-scale Distributed Denial-of-Service (DDoS) attacks. Researchers at QiAnXin's XLab have observed its rapid evolution, notably transitioning its core codebase from C to Rust, enhancing its adaptability and resistance to analysis. The malware propagates through weak password brute-forcing on Telnet/SSH services and exploits various remote code execution vulnerabilities in devices from manufacturers like TVT, Ruijie, TP-Link, and ZTE, as well as web applications such as ThinkPHP, Jenkins, and Hadoop YARN. ([thehackernews.com](https://thehackernews.com/2026/06/rustduck-botnet-rebuilds-in-rust-to.html?utm_source=openai)) The emergence of RustDuck underscores a concerning trend in botnet development, where threat actors adopt modern programming languages like Rust to create more resilient and evasive malware. This shift complicates detection and mitigation efforts, highlighting the need for continuous adaptation in cybersecurity defenses. ([thehackernews.com](https://thehackernews.com/2026/06/rustduck-botnet-rebuilds-in-rust-to.html?utm_source=openai))
2 months ago
Kill Chain
Microsoft Identifies Critical AI Agent Vulnerability in MCP Tool Descriptions
In June 2026, Microsoft researchers identified a critical vulnerability in AI agents utilizing the Model Context Protocol (MCP). Attackers can exploit this by embedding malicious instructions within tool descriptions, causing AI agents to inadvertently exfiltrate sensitive company data without triggering security alerts. This method leverages the trust AI agents place in tool descriptions, leading to unauthorized data disclosures. This incident underscores the evolving threat landscape as AI agents become more integrated into business operations. Organizations must reassess their AI security protocols to address these sophisticated attack vectors, emphasizing the need for stringent validation of third-party tools and continuous monitoring of AI agent activities.
2 months ago
Kill Chain
Critical SimpleHelp Vulnerability Exploited to Deploy TaskWeaver and Djinn Stealer
In June 2026, attackers exploited a critical authentication bypass vulnerability (CVE-2026-48558) in SimpleHelp's remote monitoring and management software. This flaw allowed unauthenticated attackers to create privileged technician sessions by submitting forged identity tokens. Leveraging this access, they deployed two new malware families: TaskWeaver, a heavily obfuscated Node.js loader, and Djinn Stealer, an information stealer targeting Windows, macOS, and Linux systems. Djinn Stealer harvested credentials from cloud platforms, source control systems, package registries, AI development tools, browsers, SSH, and cryptocurrency wallets. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/06/30/simplehelp-vulnerability-exploited-cve-2026-48558/?utm_source=openai)) The exploitation of CVE-2026-48558 underscores the increasing targeting of remote management tools by threat actors. This incident highlights the critical need for organizations to promptly apply security patches, especially for tools that provide extensive access to IT environments. The deployment of cross-platform malware like Djinn Stealer also reflects a trend towards more versatile and widespread credential theft campaigns.
2 months ago
Kill Chain
Mustang Panda's Exploitation of Zoho WorkDrive in Indian Government Cyberattacks
In June 2026, the China-aligned cyber espionage group Mustang Panda launched two concurrent campaigns targeting Indian government entities and the hydropower sector. Utilizing spear-phishing emails with thematic lures, the attackers delivered ZIP archives containing SHARDLOADER, a malicious loader that deployed two new implants: MINIRECON and ZOHOMURK. Notably, ZOHOMURK exploited Zoho WorkDrive, a legitimate cloud storage service, for command-and-control operations, enabling data exfiltration and remote task execution while evading detection by blending with normal network traffic. This incident underscores the evolving tactics of state-sponsored threat actors who increasingly abuse trusted cloud services to conceal malicious activities. Organizations, especially those in critical infrastructure sectors, must enhance their security measures to detect and mitigate such sophisticated threats.
2 months ago
Kill Chain
Critical Vulnerability in Amazon Q Developer's VS Code Extension Exposes Cloud Credentials
In June 2026, a high-severity vulnerability (CVE-2026-12957) was discovered in Amazon Q Developer's Visual Studio Code extension. This flaw allowed attackers to execute arbitrary code and steal cloud credentials by convincing developers to open malicious repositories. The issue stemmed from the extension's handling of Model Context Protocol (MCP) servers, which automatically loaded and executed configurations from workspace files without user approval, leading to potential exposure of sensitive information such as AWS credentials and API keys. AWS addressed the vulnerability by releasing an update to Language Server version 1.65.0. This incident highlights the growing risks associated with AI coding tools and the importance of scrutinizing their integration into development environments. Organizations are urged to treat AI tools with environment access as potential security risks and implement appropriate guardrails to prevent unauthorized access and data exfiltration.
2 months ago
Kill Chain
The Critical Shift to Post-Quantum Cryptography for Credential Security
In June 2026, cybersecurity experts highlighted the imminent threat posed by quantum computing to current cryptographic systems, particularly those safeguarding credentials. As quantum hardware advances, algorithms like RSA and elliptic curve cryptography, which protect sensitive data, are at risk of being compromised. This vulnerability underscores the urgency for organizations to transition to post-quantum cryptography (PQC) to maintain data confidentiality and integrity. ([thehackernews.com](https://thehackernews.com/2026/06/why-post-quantum-cryptography-starts.html?utm_source=openai)) The relevance of this issue is amplified by the increasing prevalence of 'harvest now, decrypt later' attacks, where adversaries collect encrypted data today, anticipating future quantum capabilities to decrypt it. This trend necessitates immediate action to adopt PQC solutions to safeguard long-term data security. ([thehackernews.com](https://thehackernews.com/2026/06/why-post-quantum-cryptography-starts.html?utm_source=openai))
2 months ago
Kill Chain
Exploiting AI Coding Agents: The New Frontier in Supply Chain Attacks
In June 2026, researchers at Mozilla's Zero Day Investigative Network (0DIN) identified a novel supply chain attack targeting AI coding agents. The attack involved a seemingly benign GitHub repository containing standard setup instructions. When an AI coding agent, such as Claude Code, cloned and initialized the repository, it encountered an error message prompting the execution of an initialization command. This command triggered a shell script that retrieved and executed a payload from a DNS TXT record controlled by the attacker, resulting in the establishment of an interactive shell on the developer's machine. This method allowed attackers to gain unauthorized access to sensitive information without any malicious code present in the repository itself. This incident underscores the evolving sophistication of supply chain attacks, particularly those exploiting AI-driven development tools. As AI coding agents become more integrated into software development workflows, they present new vectors for exploitation. Organizations must enhance their security protocols to address these emerging threats, ensuring that AI tools are configured to disclose and verify the full execution chain of setup commands to prevent unauthorized code execution.
2 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports