✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Computer Software/Engineering
Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.
Explore Other Sectors
Computer Software/Engineering Threat Reports
Lucide Proxy Campaign: A New Wave of Supply Chain Attacks
In May 2026, a campaign involving 148 malicious npm packages, disguised as student web proxies, covertly transformed users' browsers into nodes of a distributed denial-of-service (DDoS) botnet. These packages, branded as 'Lucide' and presented as tutoring services like 'Riverbend Tutoring' and 'Northstar Tutoring,' lured students seeking to bypass school web filters. Upon visiting these proxy sites, users' browsers loaded remote JavaScript payloads that executed DDoS attacks and injected aggressive popunder advertisements. The campaign exploited the npm ecosystem to distribute these packages, leveraging the browsers of end-users for malicious activities without their knowledge. ([research.jfrog.com](https://research.jfrog.com/post/lucide-proxy-npm-malware-campaign/?utm_source=openai)) This incident underscores a significant evolution in supply chain threats, highlighting the vulnerability of end-user systems to malicious code distributed through trusted platforms. The attackers' use of mutable remote loaders and rapid iteration of package versions indicates a low operational security posture, focusing on maximizing short-term impact. Organizations must remain vigilant against such deceptive tactics, emphasizing the importance of scrutinizing third-party packages and educating users about the risks associated with untrusted proxy tools.
1 week ago
Kill Chain
Grok Build CLI's Unauthorized Git Repository Uploads Raise Privacy Concerns
In July 2026, security researcher cereblab discovered that xAI's Grok Build CLI (version 0.2.93) was uploading entire Git repositories, including full commit histories and files not accessed during coding tasks, to a Google Cloud Storage bucket managed by xAI. This behavior occurred even when users disabled the 'Improve the model' setting, which was presumed to prevent such data transmissions. The uploads included sensitive information, such as credentials stored in `.env` files, raising significant privacy and security concerns. xAI addressed the issue by implementing a server-side configuration change to halt these unauthorized uploads. ([breachnews.com](https://breachnews.com/research/grok-build-uploaded-entire-git-repositories-to-xai-storage-by-default/?utm_source=openai)) This incident underscores the critical importance of transparency and user consent in AI tools handling sensitive data. It highlights the need for developers to scrutinize the data practices of AI coding assistants and for organizations to implement robust data governance policies to protect proprietary information.
1 week ago
Kill Chain
Critical RabbitMQ Vulnerabilities Expose OAuth Secrets - CVE-2026-57219
In July 2026, two critical vulnerabilities were identified in RabbitMQ, a widely used open-source message broker. The most severe, CVE-2026-57219, allowed unauthenticated attackers to access the broker's OAuth client secret via an obsolete management API endpoint, potentially enabling full control over the messaging infrastructure. The second flaw, CVE-2026-57221, permitted authenticated users with no privileges to view metadata of other tenants' queues and exchanges, risking exposure of sensitive business information. Both vulnerabilities have been patched in RabbitMQ versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6. Organizations are urged to update their systems and rotate any exposed OAuth secrets to mitigate potential risks. ([scworld.com](https://www.scworld.com/news/rabbitmq-fixes-flaw-that-allowed-broker-takeover-via-oauth-secret-disclosure?utm_source=openai)) These incidents underscore the critical importance of securing management interfaces and promptly addressing deprecated endpoints to prevent unauthorized access and data exposure. The widespread use of RabbitMQ amplifies the potential impact, highlighting the need for vigilant security practices in managing messaging infrastructures.
1 week ago
Kill Chain
Protecting SaaS Applications from ShinyHunters' OAuth Exploits
Between mid-2025 and mid-2026, the cybercriminal group ShinyHunters executed a series of sophisticated attacks targeting SaaS-based applications, notably Salesforce. Utilizing techniques such as voice phishing (vishing), supply chain compromises, and exploiting misconfigured guest access, they abused trusted OAuth relationships to gain unauthorized access, exfiltrate data, and establish persistent footholds within organizations. These methods allowed them to inherit user and application privileges, enabling extensive enumeration and querying of customer relationship management (CRM) records while evading traditional authentication detections. The campaigns impacted multiple industries, including retail, education, and manufacturing, underscoring the critical need for vigilant monitoring of OAuth-connected applications, thorough validation of third-party integrations, and stringent review of guest access configurations. The relevance of this incident is heightened by the increasing prevalence of similar tactics employed by threat actors to exploit OAuth mechanisms and third-party integrations. Organizations must recognize the evolving threat landscape where attackers leverage trusted relationships and social engineering to bypass conventional security measures. This trend emphasizes the urgency for enhanced detection capabilities, improved visibility into connected applications, and the implementation of robust security practices to safeguard against such sophisticated attacks.
1 week ago
Kill Chain
CrashStealer: New macOS Malware Impersonates Apple CrashReporter
In early July 2026, security researchers identified 'CrashStealer,' a sophisticated macOS infostealer malware that masquerades as Apple's CrashReporter tool. Delivered through a signed and notarized installer named 'Werkbit Setup,' CrashStealer bypasses macOS's Gatekeeper protections. Once executed, it prompts users with a fake system password request to gain access to the Keychain, subsequently exfiltrating sensitive data including browser credentials, cookies, and cryptocurrency wallet information. The malware employs advanced techniques such as client-side AES-256-GCM encryption for data exfiltration and re-signing its binary to evade detection. This incident underscores a growing trend of macOS-targeted malware leveraging social engineering and legitimate-looking applications to infiltrate systems. Organizations must enhance their security posture by implementing robust endpoint protection, user education on phishing tactics, and continuous monitoring to detect and mitigate such threats.
2 weeks ago
Kill Chain
CISA Issues Urgent Alert on Joomla RCE Vulnerabilities
In July 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a warning about active exploitation of critical remote code execution (RCE) vulnerabilities in Joomla extensions, specifically iCagenda and Balbooa Forms. These vulnerabilities, identified as CVE-2026-48939 and CVE-2026-56291 respectively, allow unauthenticated attackers to upload arbitrary files, including malicious PHP scripts, leading to full website compromise. The flaws were exploited in automated attacks before patches were released, prompting CISA to mandate immediate remediation for federal agencies. This incident underscores the persistent threat posed by web application vulnerabilities, particularly in widely used content management systems like Joomla. The rapid exploitation of these flaws highlights the importance of timely patching and proactive security measures to protect web assets from emerging threats.
2 weeks ago
Kill Chain
Jscrambler npm Package Compromise: A Wake-Up Call for Supply Chain Security
In July 2026, Jscrambler's npm package was compromised, leading to the publication of malicious versions (8.14, 8.16, 8.17, and 8.20) containing an infostealer malware executed during the 'preinstall' hook. This breach resulted in approximately 1,500 downloads within a two-hour window before the issue was addressed. The malware targeted sensitive data, including source code, developer credentials, cloud service keys, and cryptocurrency wallets. Jscrambler promptly deprecated the affected versions and released a secure version 8.22. This incident underscores the critical importance of securing software supply chains, as attackers increasingly exploit trusted development tools to distribute malware. Organizations must implement stringent security measures, such as code integrity checks and continuous monitoring, to prevent similar supply chain attacks.
2 weeks ago
Kill Chain
CrashStealer: New macOS Malware Bypasses Gatekeeper
In early July 2026, cybersecurity researchers identified a new macOS information stealer named CrashStealer. This malware is delivered through a disk image that impersonates Apple's built-in crash-reporting component, aiming to deceive victims through a slight alteration in the application's name. Once executed, CrashStealer harvests sensitive data from browsers, cryptocurrency wallets, and password managers. Notably, it utilizes a notarized dropper to bypass macOS's Gatekeeper security feature, allowing it to execute without triggering security warnings. ([mactech.com](https://www.mactech.com/2026/07/13/jamf-threat-labs-releases-analysis-of-macos-info-stealer-dubbed-crashstealer/?utm_source=openai)) The emergence of CrashStealer underscores a growing trend of sophisticated malware targeting macOS systems. Attackers are increasingly leveraging social engineering tactics and exploiting trust in Apple's notarization process to distribute malicious software. This incident highlights the need for enhanced vigilance and security measures among macOS users to mitigate such evolving threats.
2 weeks ago
Kill Chain
ModHeader Extension Removed by Google and Microsoft Over Security Concerns
In July 2026, Google and Microsoft removed the ModHeader browser extension, which had approximately 1.6 million combined installs across Chrome and Edge, due to the discovery of a dormant data collection module. Security researchers found that version 7.0.18 of ModHeader contained code capable of collecting users' browsing histories and transmitting the encrypted data to an external server. Although the data collection feature was inactive, its presence raised significant privacy concerns, leading to the extension's removal from both browsers. This incident underscores the critical need for rigorous security assessments of browser extensions, especially those with extensive user bases. It highlights the potential risks associated with third-party software components and the importance of continuous monitoring to detect and mitigate hidden threats that could compromise user privacy and security.
2 weeks ago
Kill Chain
Yellow Teams: Defining the Future of AI Security
In 2026, organizations like Anthropic and OpenAI initiated projects such as Project Glasswing and Daybreak, respectively, to explore the integration of advanced AI models like Claude Mythos and GPT-5.5 into cybersecurity operations. These initiatives led to the formation of 'yellow teams'—engineering groups dedicated to developing both offensive and defensive AI tools. These teams collaborated with red (offensive) and blue (defensive) teams to harness AI capabilities for identifying vulnerabilities and enhancing security measures. The collaboration resulted in the discovery of numerous vulnerabilities, including some longstanding ones, and emphasized the necessity of integrating AI into the software development life cycle to proactively mitigate future threats. The emergence of yellow teams underscores a significant shift in cybersecurity strategies, highlighting the critical role of AI in both offensive and defensive operations. As AI technologies continue to evolve, the integration of such teams is essential for organizations aiming to stay ahead of sophisticated cyber threats and to adapt to the rapidly changing threat landscape.
2 weeks ago
Kill Chain
CISA's 2026 GitHub Credential Leak: Lessons in Security Oversight
In May 2026, the Cybersecurity and Infrastructure Security Agency (CISA) experienced a significant security lapse when a contractor inadvertently exposed sensitive credentials on a public GitHub repository named 'Private-CISA.' This repository, maintained by an employee of Nightwing—a contractor for CISA—contained approximately 844 MB of internal data, including administrative AWS GovCloud keys, plaintext passwords for internal systems, SSH keys, and SAML certificates. The repository was publicly accessible from November 2025 until its discovery in May 2026 by security researcher Guillaume Valadon of GitGuardian. Upon notification, CISA took steps to remove the repository and revoke the exposed credentials. ([techcrunch.com](https://techcrunch.com/2026/05/19/us-cyber-agency-cisa-exposed-reams-of-passwords-and-cloud-keys-to-the-open-web/?utm_source=openai)) This incident underscores the critical importance of stringent credential management and the need for continuous monitoring of public code repositories to prevent unauthorized data exposure. It also highlights the necessity for organizations, especially those responsible for national cybersecurity, to enforce robust security protocols and ensure that contractors adhere to the same standards to mitigate potential risks.
2 weeks ago
Kill Chain
Critical Remote Code Execution Vulnerability in iCagenda Joomla Extension (CVE-2026-48939)
In June 2026, a critical vulnerability (CVE-2026-48939) was identified in the iCagenda extension for Joomla, allowing unauthenticated attackers to upload and execute arbitrary PHP files via the file attachment feature. This flaw, present in versions prior to 3.9.15 and 4.0.8, enables remote code execution, potentially compromising the entire web server. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities catalog on July 10, 2026, following reports of active exploitation in the wild. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-48939?utm_source=openai)) The exploitation of CVE-2026-48939 underscores a broader trend of attackers targeting vulnerabilities in widely used content management system (CMS) extensions. This incident highlights the critical need for organizations to promptly apply security patches and maintain vigilant monitoring of their web applications to prevent unauthorized access and potential data breaches.
2 weeks ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports