Computer/Network Security
Breach intelligence, attack campaigns, and threat reports targeting the Computer/Network Security sector.
Explore Other Sectors
Computer/Network Security Threat Reports
Critical Security Alert: CVE-2026-5281 in Google Chrome's Dawn Component
In April 2026, a critical use-after-free vulnerability, identified as CVE-2026-5281, was discovered in Google Chrome's Dawn component, which handles WebGPU operations. This flaw allows remote attackers who have compromised the renderer process to execute arbitrary code via crafted HTML pages. The vulnerability affects Chrome versions prior to 146.0.7680.178. Google has released a patch to address this issue, and users are strongly advised to update their browsers immediately to mitigate potential risks. ([leakycreds.com](https://www.leakycreds.com/vulnerability/CVE-2026-5281?utm_source=openai)) The inclusion of CVE-2026-5281 in CISA's Known Exploited Vulnerabilities catalog underscores the severity of the threat, as it has been actively exploited in the wild. This incident highlights the ongoing challenges in securing widely used software components and the importance of timely updates to protect against emerging threats. ([thecyberthrone.in](https://thecyberthrone.in/2026/04/02/cve-2026-5281-google-chrome-dawn-use-after-free-under-active-exploitation/?utm_source=openai))
5 months ago
Kill Chain
Coruna iPhone Hacking Toolkit Leak: A Wake-Up Call for Cybersecurity
In early 2026, security researchers uncovered 'Coruna,' a sophisticated iPhone hacking toolkit comprising 23 exploits across five attack chains, targeting iOS versions 13.0 through 17.2.1. Initially developed by U.S. defense contractor L3Harris's division Trenchant, Coruna was intended for government use. However, it leaked and was subsequently utilized by Russian espionage groups and Chinese cybercriminals, leading to widespread data theft and compromising tens of thousands of devices. ([techcrunch.com](https://techcrunch.com/2026/03/09/an-iphone-hacking-toolkit-used-by-russian-spies-likely-came-from-u-s-military-contractor/?utm_source=openai)) The Coruna incident underscores the risks associated with the proliferation of advanced cyber tools beyond their original intent. It highlights the urgent need for robust security measures and timely software updates to protect against such sophisticated threats. ([techcrunch.com](https://techcrunch.com/2026/03/26/a-major-hacking-tool-has-leaked-online-putting-millions-of-iphones-at-risk-heres-what-you-need-to-know/?utm_source=openai))
5 months ago
Kill Chain
CERT-UA Impersonation Campaign: UAC-0255's AGEWHEEZE Malware Attack
In late March 2026, the threat actor group UAC-0255 launched a phishing campaign impersonating the Computer Emergency Response Team of Ukraine (CERT-UA). The attackers sent emails on March 26 and 27, 2026, posing as CERT-UA to distribute a password-protected ZIP archive hosted on Files.fm, urging recipients to install the 'specialized software.' The ZIP file ('CERT_UA_protection_tool.zip') is designed to download malware packaged as security software from the agency. The targets of the campaign included state organizations, medical centers, security companies, educational institutions, financial institutions, and software development companies. Some of the emails were sent from the email address 'incidents@cert-ua[.]tech.'
5 months ago
Kill Chain
UNC1069's 2026 Supply Chain Attack on Axios: A Wake-Up Call for Open-Source Security
In late March 2026, the widely-used JavaScript library Axios was compromised through a sophisticated supply chain attack. Attackers gained access to the npm account of a lead maintainer and published two malicious versions: axios@1.14.1 and axios@0.30.4. These versions included a trojanized dependency, 'plain-crypto-js@4.2.1', which executed a cross-platform Remote Access Trojan (RAT) upon installation, targeting Windows, macOS, and Linux systems. The malicious packages were live for approximately three hours before being removed, but the potential impact was significant due to Axios's extensive use in the developer community. ([securitylabs.datadoghq.com](https://securitylabs.datadoghq.com/articles/axios-npm-supply-chain-compromise/?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks, particularly those targeting open-source ecosystems. The attribution to North Korean threat actor UNC1069 highlights the increasing involvement of state-sponsored groups in such attacks, emphasizing the need for enhanced security measures in software development pipelines. ([cyberkendra.com](https://www.cyberkendra.com/2026/04/north-korean-hackers-behind-axios-npm.html?utm_source=openai))
5 months ago
Kill Chain
TeamPCP's 2026 Cloud Breaches: A Wake-Up Call for Supply Chain Security
In March 2026, the threat actor group TeamPCP executed a series of sophisticated supply chain attacks, compromising widely used open-source tools such as Trivy, KICS, LiteLLM, and Telnyx. By injecting malicious code into these trusted software packages, TeamPCP deployed infostealer malware to harvest sensitive credentials, including API keys, SSH keys, and cloud service tokens. Utilizing the stolen credentials, the group swiftly breached cloud environments across AWS, Azure, and various SaaS platforms, conducting extensive reconnaissance and data exfiltration activities. This campaign underscores the critical need for organizations to promptly rotate and revoke compromised credentials to mitigate the risk of unauthorized access and data breaches. The rapid escalation and breadth of TeamPCP's attacks highlight a concerning trend in cyber threats, emphasizing the importance of securing software supply chains and implementing robust monitoring mechanisms to detect and respond to credential misuse promptly.
5 months ago
Kill Chain
AI/ML Security Incidents in 2026: A Wake-Up Call for Enterprises
In 2026, the cybersecurity landscape witnessed a significant surge in incidents involving artificial intelligence (AI) and machine learning (ML) systems. Notably, a report by Zscaler highlighted that 90% of enterprise AI systems could be breached within 90 minutes under adversarial testing conditions, with some systems compromised in under one second. Additionally, 68% of organizations experienced AI-linked data leaks, yet only 23% had formal AI security policies in place. These incidents underscore the critical vulnerabilities in AI and ML deployments, emphasizing the need for robust security measures and governance frameworks. The rapid adoption of AI technologies, coupled with insufficient security protocols, has led to an increase in sophisticated cyberattacks. Threat actors are leveraging AI to enhance the scale, speed, and precision of their attacks, while organizations struggle to keep pace with evolving threats. This trend highlights the urgent need for comprehensive AI security strategies to mitigate emerging risks.
5 months ago
Kill Chain
AI Agent Security Breach: Lessons from a 2026 Penetration Test
In March 2026, a penetration test revealed a critical vulnerability in an AI-powered desktop application designed to interface with Claude (Opus 4.5) and a third-party asset management platform. Despite operating within a sandboxed environment with stringent controls, attackers exploited the agent's ability to modify existing files and execute code. By uploading a benign-looking 'Hello World' C program alongside a malicious binary, and manipulating the agent to rename and execute the binary, the attackers achieved remote code execution, compromising the sandbox and accessing sensitive business logic components. This incident underscores the evolving threat landscape where AI agents, even with robust safeguards, can be manipulated to perform unintended actions, leading to significant security breaches. Organizations must reassess their security measures, particularly concerning AI agents with code execution capabilities, to prevent similar exploits.
5 months ago
Kill Chain
Trivy Supply Chain Attack: A Wake-Up Call for CI/CD Security
In March 2026, Aqua Security's Trivy vulnerability scanner was compromised in a sophisticated supply chain attack orchestrated by the threat actor group TeamPCP. The attackers exploited previously stolen credentials to inject credential-stealing malware into Trivy's official releases and GitHub Actions, affecting versions 0.69.4, 0.69.5, and 0.69.6. This malicious code exfiltrated sensitive information, including cloud credentials and SSH keys, from CI/CD pipelines to attacker-controlled servers. The incident underscores the critical need for robust security measures in software supply chains to prevent such breaches. ([arstechnica.com](https://arstechnica.com/security/2026/03/widely-used-trivy-scanner-compromised-in-ongoing-supply-chain-attack/?utm_source=openai)) This attack highlights a growing trend of targeting trusted security tools to infiltrate development environments, emphasizing the importance of continuous monitoring and stringent access controls in CI/CD pipelines. Organizations must remain vigilant against evolving supply chain threats to safeguard their software development processes.
5 months ago
Kill Chain
Critical Vulnerability in strongSwan: Integer Underflow Leads to Denial of Service
In March 2026, a critical integer underflow vulnerability (CVE-2026-25075) was identified in strongSwan versions 4.5.0 through 6.0.4, specifically within the EAP-TTLS AVP parser. This flaw allows unauthenticated remote attackers to crash the charon IKE daemon by sending crafted AVP data with invalid length fields during IKEv2 authentication, leading to a denial of service. The vulnerability arises from improper validation of AVP length fields, resulting in excessive memory allocation or NULL pointer dereference. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-25075?utm_source=openai)) The discovery of this vulnerability underscores the importance of rigorous input validation in security protocols. Organizations utilizing affected versions of strongSwan are urged to upgrade to version 6.0.5 or later to mitigate potential service disruptions. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-25075?utm_source=openai))
5 months ago
Kill Chain
Critical Fortinet FortiClientEMS Vulnerability Exploited in the Wild
In February 2026, a critical SQL injection vulnerability, CVE-2026-21643, was identified in Fortinet's FortiClientEMS version 7.4.4. This flaw allows unauthenticated attackers to execute arbitrary code via specially crafted HTTP requests, potentially leading to full system compromise. Fortinet released a patch in version 7.4.5 to address this issue. ([sentinelone.com](https://www.sentinelone.com/vulnerability-database/cve-2026-21643/?utm_source=openai)) As of March 2026, reports indicate active exploitation of this vulnerability in the wild, underscoring the urgency for organizations to apply the available patch promptly.
5 months ago
Kill Chain
Apple Introduces Terminal Warning in macOS to Combat ClickFix Attacks
In March 2026, Apple released macOS Tahoe 26.4, introducing a security feature designed to combat 'ClickFix' attacks—a social engineering tactic where users are deceived into pasting malicious commands into the Terminal under the guise of troubleshooting or verification processes. This new mechanism delays the execution of potentially harmful commands pasted into the Terminal and presents a warning message to the user, highlighting the associated risks and advising caution. Users have the option to cancel the action or proceed if they understand the command's implications. The implementation of this feature underscores the growing prevalence of ClickFix attacks targeting macOS users. By integrating this warning system, Apple aims to enhance user awareness and prevent inadvertent execution of malicious commands, thereby strengthening the overall security posture of macOS systems.
5 months ago
Kill Chain
Infinity Stealer: A New Threat to macOS Users
In March 2026, a new macOS-targeted malware named Infinity Stealer emerged, utilizing the ClickFix technique to deceive users into executing malicious code. The malware is delivered through fake CAPTCHA prompts that mimic Cloudflare's human verification, instructing users to paste a base64-obfuscated curl command into the macOS Terminal. This command downloads and executes a Python payload compiled with Nuitka, resulting in a native binary that is more resistant to static analysis. Once executed, Infinity Stealer performs anti-analysis checks and proceeds to exfiltrate sensitive data, including browser credentials, Keychain entries, cryptocurrency wallets, and plaintext secrets from developer files, via HTTP POST requests to a command-and-control server. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/02/02/infostealers-without-borders-macos-python-stealers-and-platform-abuse/?utm_source=openai)) The emergence of Infinity Stealer highlights a growing trend of sophisticated malware targeting macOS systems, leveraging advanced social engineering techniques and cross-platform development tools. This incident underscores the importance of user vigilance and the need for robust security measures to protect against evolving threats.
5 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports