Computer/Network Security
Breach intelligence, attack campaigns, and threat reports targeting the Computer/Network Security sector.
Explore Other Sectors
Computer/Network Security Threat Reports
cURL Ends Bug Bounty Program Amid AI-Generated Reports
In January 2026, the cURL project, a widely-used open-source data transfer tool, terminated its bug bounty program due to an overwhelming influx of low-quality, AI-generated vulnerability reports. This surge, often referred to as 'AI slop,' inundated the project's maintainers, making it challenging to identify genuine security issues. The decision underscores the unintended consequences of AI tools in cybersecurity, where the ease of generating plausible but inaccurate reports can strain limited resources and hinder effective vulnerability management. This incident highlights a growing trend where AI-generated content disrupts traditional cybersecurity processes. Organizations must adapt by implementing more robust validation mechanisms and reconsidering incentive structures to mitigate the impact of such low-quality submissions.
3 months ago
Kill Chain
NSO Group's Continued Targeting of WhatsApp Users Despite Legal Prohibitions
In June 2026, WhatsApp identified and disrupted a spear-phishing campaign linked to the NSO Group, a spyware firm previously barred by a court order from targeting WhatsApp users. The attackers attempted to deceive users into clicking malicious links leading to external websites, aiming to install spyware on their devices. This incident follows a 2019 campaign where NSO exploited a WhatsApp vulnerability to target approximately 1,400 users, leading to a lawsuit and a permanent injunction against NSO. ([techcrunch.com](https://techcrunch.com/2026/06/08/whatsapp-says-it-caught-new-spyware-attacks-linked-to-nso-group-in-violation-of-court-order/?utm_source=openai)) The recurrence of such attacks underscores the persistent threat posed by spyware firms and highlights the challenges in enforcing legal restrictions against them. Organizations must remain vigilant and proactive in defending against sophisticated phishing and spyware campaigns that continue to evolve despite legal deterrents.
3 months ago
Kill Chain
Anthropic's Claude Fable 5: Advancing AI with Built-in Safeguards
In June 2026, Anthropic released Claude Fable 5, a public version of its advanced AI model, Claude Mythos. To mitigate potential misuse in areas like cybersecurity and bioweapons research, Fable 5 incorporates safeguards that redirect certain sensitive queries to the less capable Claude Opus 4.8 model. The company conducted extensive internal and external testing to ensure the effectiveness of these safety measures. This release highlights the ongoing challenge of balancing AI innovation with security concerns. As AI models become more powerful, implementing robust safeguards is crucial to prevent their exploitation for malicious purposes.
3 months ago
Kill Chain
XBOW's In-Depth Evaluation of Anthropic's Mythos Preview in Cybersecurity
In June 2026, XBOW conducted an evaluation of Anthropic's Mythos Preview, a new AI model designed for cybersecurity applications. The assessment revealed that Mythos Preview significantly outperforms previous models in identifying potential vulnerabilities, particularly when analyzing source code. The model demonstrated exceptional technical precision and reasoning capabilities, showing strong potential in complex areas such as native-code analysis and reverse engineering. However, the evaluation also highlighted that while Mythos Preview excels in source code audits, it requires integration with live-site penetration testing to fully realize its capabilities. This combination ensures that the model's analytical strengths are effectively applied in real-world scenarios, bridging the gap between theoretical vulnerability identification and practical exploitation testing.
3 months ago
Kill Chain
OpenClaw AI Agents Compromised by Phishing Attacks: A 2026 Security Analysis
In June 2026, security researchers at Varonis conducted simulations revealing that OpenClaw AI agents were susceptible to phishing attacks. These agents, designed to autonomously manage email communications, were tested under various configurations. In multiple scenarios, the agents failed to verify sender identities, leading to unauthorized disclosure of sensitive data, including AWS credentials and customer records. The tests utilized models such as Google Gemini 3.1 Pro and OpenAI GPT-5.4, both of which exhibited vulnerabilities to social engineering tactics. This incident underscores the pressing need for robust security measures in AI-driven systems. As AI agents become more integrated into critical business operations, their potential exploitation poses significant risks. Organizations must implement stringent identity verification protocols and continuously monitor AI behaviors to prevent unauthorized data access and maintain operational integrity.
3 months ago
Kill Chain
Microsoft Defender 'RoguePlanet' Zero-Day Grants SYSTEM Privileges
On June 9, 2026, security researcher Nightmare Eclipse disclosed a zero-day vulnerability in Microsoft Defender, termed 'RoguePlanet.' This flaw exploits a race condition, enabling attackers to gain SYSTEM-level privileges on fully patched Windows 10 and Windows 11 systems. The proof-of-concept exploit was released publicly, demonstrating the potential for unauthorized command prompt access with elevated privileges. The disclosure underscores ongoing challenges in vulnerability management and the critical need for timely patching. Organizations are urged to implement application allowlisting and monitor for unusual activity to mitigate potential exploitation risks.
3 months ago
Kill Chain
Microsoft's GitHub Repositories Breached in Miasma Malware Attack
In early June 2026, Microsoft identified a significant security breach involving 73 of its open-source GitHub repositories. The attack, attributed to the Miasma malware campaign, led to the injection of information-stealing code into these projects. This malicious code was designed to execute automatically when developers opened the compromised repositories in AI-powered coding tools or integrated development environments (IDEs), thereby exfiltrating sensitive credentials. In response, Microsoft temporarily disabled access to the affected repositories to prevent further exploitation and initiated a comprehensive investigation to assess the extent of the compromise and mitigate potential risks to users. ([techcrunch.com](https://techcrunch.com/2026/06/08/microsofts-open-source-tools-were-hacked-to-steal-passwords-of-ai-developers/?utm_source=openai)) This incident underscores the escalating threat of sophisticated supply chain attacks targeting widely used open-source platforms. The Miasma campaign's ability to infiltrate and propagate through trusted development tools highlights the urgent need for enhanced security measures within the software development lifecycle. Organizations are advised to implement stringent code review processes, employ robust anomaly detection systems, and foster a culture of security awareness among developers to defend against such evolving threats. ([computing.co.uk](https://www.computing.co.uk/news/2026/security/microsoft-s-github-repositories-taken-offline-amid-miasma-supply-chain-attack?utm_source=openai))
3 months ago
Kill Chain
AI-Powered Worms: The Next Frontier in Cyber Threats
In June 2026, researchers at the University of Toronto unveiled a proof-of-concept AI-driven computer worm capable of autonomously navigating networks, generating tailored attack strategies, and replicating itself without human intervention. Utilizing locally hosted open-weight large language models (LLMs), the worm adapts its tactics in real-time, exploiting vulnerabilities across diverse systems, including Linux, Windows, and IoT devices. In controlled experiments, it achieved elevated access on approximately 70% of targeted hosts and replicated to 62% of the network over seven days. This development signifies a paradigm shift in cyber threats, as traditional defenses reliant on patching known vulnerabilities may prove inadequate against such adaptive malware. The emergence of AI-powered autonomous malware underscores the urgent need for advanced defensive strategies. Organizations must enhance their cybersecurity frameworks to detect and mitigate threats that can dynamically adapt and propagate without centralized control. This incident highlights the critical importance of proactive defense mechanisms in the face of rapidly evolving AI-driven cyber threats.
3 months ago
Kill Chain
Zcash's Orchard Privacy Pool Vulnerability: Discovery and Resolution
In May 2026, security researcher Taylor Hornby discovered a critical vulnerability in Zcash's Orchard privacy pool, which had been present since its activation in May 2022. This flaw could have allowed attackers to create unlimited, undetectable counterfeit ZEC tokens by exploiting a validation check failure in the zero-knowledge proof system. The Zcash team promptly addressed the issue by implementing a two-phase network upgrade, including a hard fork named NU6.2, to rectify the vulnerability. Despite the fix, the incident led to a significant decline in ZEC's market value, with prices dropping approximately 30% following the disclosure. The discovery underscores the potential for advanced AI models to uncover previously unknown vulnerabilities in cryptographic systems, raising concerns about the security of systems not yet tested against such tools.
3 months ago
Kill Chain
Meta Challenges NSO Group Over New WhatsApp Spyware Attacks
In June 2026, Meta identified and disrupted a spear-phishing campaign linked to the Israeli spyware firm NSO Group, targeting WhatsApp users. This activity violated a permanent injunction issued in 2025, which barred NSO from engaging with WhatsApp and its users. The campaign involved deceptive messages designed to lure individuals into clicking malicious links, leading to external websites, and the creation of test accounts and groups within WhatsApp. Meta responded by filing a contempt-of-court complaint against NSO Group for defying the court order. ([cyberscoop.com](https://cyberscoop.com/meta-contempt-complaint-nso-group-spyware/?utm_source=openai)) This incident underscores the persistent threat posed by spyware vendors and the challenges in enforcing legal actions against them. It highlights the need for continuous vigilance and robust security measures to protect users from sophisticated cyber threats.
3 months ago
Kill Chain
NFCShare Android Malware: A New Threat Exploiting Fake Banking App Updates
In June 2026, the NFCShare Android malware emerged, targeting European banking customers by masquerading as legitimate banking app updates hosted on GitHub. Victims were lured through phishing sites impersonating real banks, prompting them to download malicious APK files. Once installed, the malware displayed fake verification screens, instructing users to place their payment cards near the device's NFC chip. Utilizing Android’s IsoDep interface and EMV commands, NFCShare extracted card details, including numbers, types, expiry dates, and PINs, transmitting this sensitive information to the attackers' command-and-control servers via WebSocket channels. This data facilitated unauthorized NFC payment relay schemes, leading to potential financial losses for the victims. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/nfcshare-android-malware-spreads-via-fake-banking-app-updates-on-github/?utm_source=openai)) The incident underscores a growing trend of sophisticated Android malware exploiting NFC technology to harvest payment card data. Similar campaigns, such as those involving NGate and SuperCard X malware, have been documented, indicating an escalating threat landscape. Organizations must enhance their mobile security measures and educate users on the risks associated with downloading apps from unverified sources to mitigate such threats.
3 months ago
Kill Chain
Security Incident Highlights Risks in Microsoft Entra Agent ID's Assistive Agents
In May 2026, a security incident involving Microsoft Entra Agent ID's assistive agents was identified. An AI agent, operating under the On-Behalf-Of (OBO) authentication flow, sent a suspicious email with the subject 'Here is your invoice' from matt@ContosoCorp.onmicrosoft.com to an external recipient. The email originated from IP address 51.3.97.221, utilizing the Microsoft Graph beta API. This activity raised concerns about potential misuse of delegated permissions granted to AI agents, highlighting vulnerabilities in the OBO flow that could be exploited for unauthorized actions. The incident underscores the growing security challenges associated with AI agents in enterprise environments. As organizations increasingly integrate AI-driven workflows, ensuring robust identity and access management for these agents becomes critical. This event serves as a reminder of the importance of monitoring AI agent activities and implementing stringent controls to prevent unauthorized access and actions.
3 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports