Computer/Network Security
Breach intelligence, attack campaigns, and threat reports targeting the Computer/Network Security sector.
Explore Other Sectors
Computer/Network Security Threat Reports
Klue OAuth Breach 2026: Lessons in Third-Party Integration Security
In June 2026, Klue, a market intelligence platform, experienced a security breach where attackers exploited a compromised legacy credential to access Klue's integration infrastructure. This allowed them to steal OAuth tokens used to connect Klue with third-party platforms, notably Salesforce. Utilizing these tokens, the attackers accessed and exfiltrated data from multiple customer Salesforce environments. The incident was publicly claimed by the 'Icarus' extortion group, which pressured affected organizations to contact them to prevent the leaking of stolen data. This breach underscores the critical vulnerabilities associated with third-party integrations and the OAuth protocol. It highlights the necessity for organizations to rigorously monitor and manage third-party access, regularly audit integration credentials, and implement robust security measures to prevent unauthorized access through supply chain vectors.
3 months ago
Kill Chain
Belgian Bank Customers Targeted in Sophisticated Phishing Attack Using IPv4-Mapped IPv6 Addresses
In June 2026, a phishing campaign targeted customers of a major Belgian bank by exploiting IPv4-mapped IPv6 addresses to obfuscate malicious URLs. The attackers sent emails containing links formatted as IPv6 literals, such as 'hxxp://[::ffff:5511:74be]/kWC5PHA1', which, when decoded, resolved to an IPv4 address hosting the phishing content. This technique aimed to bypass security controls that rely on detecting suspicious domain names or IP addresses. Upon clicking the link, victims were redirected to a fraudulent website designed to harvest sensitive banking credentials. The campaign underscores the evolving tactics of cybercriminals in leveraging less commonly monitored aspects of internet protocols to evade detection. ([isc.sans.edu](https://isc.sans.edu/diary/32804?utm_source=openai)) The use of IPv4-mapped IPv6 addresses in phishing attacks highlights a growing trend where attackers exploit the complexities of IPv6 to conceal malicious activities. As IPv6 adoption increases, security systems must adapt to recognize and mitigate threats that utilize these advanced obfuscation methods. Organizations are urged to enhance their monitoring capabilities to detect such techniques and educate users about the risks associated with unfamiliar URL formats.
3 months ago
Kill Chain
Operation Endgame: A Major Blow to SocGholish Malware Infrastructure
In June 2026, an international law enforcement coalition comprising agencies from the Netherlands, Canada, the United States, and Germany executed Operation Endgame, targeting the SocGholish malware infrastructure. This coordinated effort led to the takedown of 106 servers and the remediation of 14,971 WordPress websites infected with SocGholish, a JavaScript-based downloader malware. SocGholish, active since 2017, masquerades as browser updates to distribute additional malicious payloads, often leading to ransomware attacks orchestrated by groups like Evil Corp. The operation significantly disrupted the malware's distribution channels, mitigating further risks to global digital systems. ([politie.nl](https://www.politie.nl/en/news/2026/june/18/international-law-enforcement-initiate-hunt-on-malware-group-socgholish.html?utm_source=openai)) The success of Operation Endgame underscores the effectiveness of international collaboration in combating cyber threats. However, the persistent evolution of malware tactics necessitates continuous vigilance and adaptive cybersecurity measures. Organizations are urged to regularly update their systems, monitor for unauthorized access, and educate users about the dangers of deceptive software updates to prevent future infections.
3 months ago
Kill Chain
Anthropic's Fable 5 AI Model Suspended Amid National Security Concerns
In June 2026, Anthropic released its advanced AI model, Fable 5, designed to autonomously identify and exploit software vulnerabilities. Shortly after its release, the U.S. government classified Fable 5 as a potential national security threat, citing concerns over its capability to be 'jailbroken' and misused by malicious actors. Consequently, Anthropic was ordered to suspend access to the model for all foreign nationals, leading the company to disable Fable 5 entirely due to the inability to selectively restrict access. This abrupt shutdown has sparked significant debate within the cybersecurity community, with experts arguing that such restrictions may hinder defensive research more than deter malicious use. The incident underscores the challenges in balancing AI innovation with national security and the need for clear regulatory frameworks to manage the dual-use nature of advanced AI technologies.
3 months ago
Kill Chain
USB Worm Targets Cryptocurrency Wallets via Windows Shortcut Files
In June 2026, a sophisticated USB worm emerged, targeting cryptocurrency wallets by distributing clipboard-stealing malware through Windows shortcut (LNK) files on USB drives. Upon execution, the malware scans the system for document files, hides the originals, and replaces them with malicious shortcuts. It monitors clipboard activity to detect and replace cryptocurrency wallet addresses with those controlled by the attacker, captures screenshots, and exfiltrates data via the Tor network. The worm also propagates by copying itself to newly connected USB devices, facilitating further spread. This incident underscores the evolving tactics of threat actors leveraging removable media to infiltrate systems, emphasizing the need for heightened vigilance and robust security measures to protect sensitive financial information.
3 months ago
Kill Chain
Salesforce Data Breach via Klue App Compromise
In June 2026, threat actors exploited OAuth tokens from Klue's Battlecards app to access Salesforce instances, leading to unauthorized data exfiltration. This incident mirrors previous breaches involving third-party integrations like Salesloft's Drift and Gainsight, highlighting the persistent risks associated with SaaS application connections. The attackers authenticated through a compromised Klue integration service account, generating OAuth tokens that granted access to customers' integrated Salesforce environments. The exfiltration process involved automated scripts querying the Salesforce REST API over a 24-hour period, with some instances experiencing concentrated bursts of nearly a thousand queries in 15 minutes. This breach underscores the critical need for organizations to scrutinize third-party integrations and enforce stringent security measures to protect sensitive data. The recurrence of such attacks emphasizes the importance of continuous monitoring and the implementation of robust security protocols to mitigate risks associated with third-party applications.
3 months ago
Kill Chain
Red Hat npm Supply Chain Attack: A Wake-Up Call for Software Security
In June 2026, Red Hat's npm packages were compromised in a significant supply chain attack. Threat actors infiltrated the @redhat-cloud-services namespace, injecting a credential-stealing worm into 32 packages, affecting 96 versions. These malicious packages, downloaded over 116,000 times weekly, exploited GitHub Actions' OpenID Connect to publish the compromised code, indicating a breach in the CI/CD pipeline. The attack led to unauthorized access to sensitive credentials, posing substantial risks to downstream users. ([aikido.dev](https://www.aikido.dev/blog/red-hat-npm-packages-compromised-credential-stealing-worm?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting trusted software ecosystems. Organizations must enhance their security measures, particularly in CI/CD pipelines, to prevent similar breaches. The event highlights the necessity for continuous monitoring and rapid response strategies to mitigate the impact of such sophisticated attacks.
3 months ago
Kill Chain
Surge in SSH Brute Force Attacks Correlates with Global Events in 2026
Between February and May 2026, a DShield honeypot recorded over 20 million SSH brute-force attempts, revealing a significant correlation between attack volumes and external events such as geopolitical tensions and cybersecurity advisories. Notably, a 2100% surge in attacks coincided with CISA's Emergency Directive 26-03 addressing Cisco SD-WAN vulnerabilities, and peaks in activity aligned with escalating conflicts involving Iran, Israel, and the United States. These findings underscore the adaptability of threat actors who exploit global events to intensify their malicious activities. The study highlights the persistent threat posed by coordinated SSH brute-force attacks and the necessity for organizations to implement robust security measures. As attackers continue to leverage global events to orchestrate large-scale attacks, it is imperative for entities to enhance their defenses, monitor for unusual activity, and stay informed about emerging threats to mitigate potential breaches.
3 months ago
Kill Chain
Crypto Clipper Malware: A New Threat Leveraging Tor and Worm-Like Propagation
In February 2026, Microsoft identified a Windows-based cryptocurrency clipper malware that propagates via malicious shortcut (.lnk) files. This malware comprises a worm component for self-propagation and a stealer component that harvests and exfiltrates cryptocurrency wallet information. Notably, it utilizes Windows Script Host and ActiveX to launch a bundled Tor proxy, enabling communication with a hidden-service command-and-control (C2) server. The malware performs high-frequency clipboard monitoring, screenshot exfiltration, and wallet-address substitution, effectively turning a financially motivated stealer into a lightweight backdoor. The incident underscores the evolving sophistication of malware leveraging anonymized communication channels like Tor and worm-like propagation methods. Organizations should be vigilant about script-based threats and implement behavioral detection mechanisms to identify suspicious activities such as script interpreters spawning unexpected child processes, localhost proxy usage, and clipboard inspection behaviors.
3 months ago
Kill Chain
FreeBSD CVE-2026-3038: Understanding the Critical Kernel Vulnerability
In March 2026, a critical vulnerability identified as CVE-2026-3038 was discovered in the FreeBSD kernel's rtsock_msg_buffer() function. This flaw allows unprivileged users to trigger a stack buffer overflow by crafting malicious routing socket requests, leading to immediate kernel panics due to stack canary corruption. The vulnerability affects FreeBSD versions 13.5, 14.3, and 15.0 prior to specific patches. ([cve.org](https://www.cve.org/CVERecord?id=CVE-2026-3038&utm_source=openai)) The discovery of CVE-2026-3038 underscores the ongoing challenges in securing kernel-level code, highlighting the need for rigorous validation of user-supplied data. This incident serves as a reminder of the importance of timely patching and continuous monitoring to mitigate potential exploits that could lead to system crashes or privilege escalation.
3 months ago
Kill Chain
Malware Developers Use Forbidden Text to Thwart AI Analysis
In June 2026, security researchers identified a novel technique where malware developers embed forbidden text related to nuclear and biological weapons within spyware code. This method aims to disrupt AI-based analysis tools by causing them to refuse processing or misclassify the malware, thereby evading detection. The malicious code is concealed within large JavaScript comments containing sensitive keywords, followed by obfuscated payloads executed at runtime. This approach targets AI systems that lack robust content isolation, leading to analysis failures and potential security breaches. This incident underscores the evolving tactics of cyber adversaries who exploit AI vulnerabilities to bypass detection mechanisms. The use of forbidden text to manipulate AI analysis highlights the need for enhanced security measures in AI-driven systems, emphasizing the importance of developing resilient AI models capable of handling adversarial inputs without compromising performance.
3 months ago
Kill Chain
Critical FortiSandbox Vulnerabilities Exploited: Immediate Action Required
In June 2026, attackers began exploiting critical vulnerabilities in Fortinet's FortiSandbox, specifically CVE-2026-39808 and CVE-2026-39813. These flaws, disclosed and patched in April 2026, allow unauthenticated code execution and authentication bypass, respectively. Despite the availability of patches, threat actors have initiated attacks, potentially compromising systems that rely on FortiSandbox for threat analysis and detection. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/06/16/fortisandbox-vulnerabilities-cve-2026-39813-cve-2026-39808-cve-2026-25089/?utm_source=openai)) This incident underscores the persistent risk posed by unpatched vulnerabilities in critical security infrastructure. Organizations must prioritize timely application of security updates to mitigate such threats and maintain the integrity of their defense mechanisms.
3 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports