✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Computer Software/Engineering
Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.
Explore Other Sectors
Computer Software/Engineering Threat Reports
Malicious npm Package Attack Exposes Software Supply Chain Risks in 2024
In June 2024, security researchers identified a supply chain attack involving at least ten malicious npm packages uploaded to the public registry. Masquerading as legitimate software components, these packages were designed to infect developer environments across Windows, Linux, and macOS. Once installed, they downloaded and executed an information-stealing payload capable of harvesting sensitive data such as credentials and environment variables, potentially enabling lateral movement or further breaches within affected organizations. The attack leveraged trusted software distribution channels to bypass traditional defenses and amplify impact among open-source users. This incident underlines escalating risks in the software supply chain, highlighting how open-source package ecosystems have become prime targets for attackers. The trend represents a growing challenge for organizations relying on third-party code, driving new urgency around vetting procedures, continuous monitoring, and enforcing granular security controls in developer pipelines.
6 months ago
Kill Chain
10 Malicious npm Packages Expose Global Supply Chain Risks in 2025 Credential Stealer Attack
In October 2025, security researchers uncovered a coordinated supply chain attack targeting the npm ecosystem. Ten malicious npm packages, collectively downloaded over 5,000 times, were found to contain sophisticated multi-platform information stealers. These packages, distributed via the npm registry and impersonating legitimate developer tools, leveraged obfuscated code to deploy a payload capable of extracting sensitive credentials and environment data from Windows, macOS, and Linux developer workstations. The malware used deceptive tactics like a fake CAPTCHA screen and fingerprinted victims prior to exfiltrating stolen data to attacker-controlled infrastructure. This incident underscores the growing trend of software supply chain attacks, as developer tool ecosystems like npm remain high-value targets for both financially motivated cybercriminals and state-sponsored groups. The event has fueled concerns about package registry hygiene, developer workstation security, and the need for stronger zero trust and anomaly detection controls across the software development lifecycle.
6 months ago
Kill Chain
Cloaking Attack Against AI Crawlers Uncovers New Context Poisoning Risks
In October 2025, cybersecurity researchers uncovered a sophisticated cloaking attack that targets AI-driven web crawlers used by popular agentic browsers such as OpenAI ChatGPT Atlas and Perplexity. Threat actors deployed malicious websites capable of serving misleading or false content only to AIbots, while displaying legitimate information to typical users. This context poisoning technique allows harmful actors to manipulate AI models at scale, tricking them into citing fabricated facts as verified information, and undermines AI trustworthiness with widespread downstream effects on automated decision-making and knowledge dissemination. This incident highlights the mounting risks from adversarial attacks targeting AI supply chains. As AI systems increasingly rely on real-time internet data, attackers are innovating new manipulation tactics to poison context and subvert trust. The surge in such TTPs coincides with tighter regulations and industry push towards Responsible AI frameworks.
6 months ago
Kill Chain
Aisuru Botnet’s 2025 Shift: From DDoS Disruptor to Proxy Powerhouse
In mid-2025, the Aisuru botnet—already infamous for record-shattering distributed denial-of-service (DDoS) attacks—shifted tactics, repurposing hundreds of thousands of compromised Internet of Things (IoT) devices to fuel residential proxy networks. Initially detected in August 2024, Aisuru rapidly infected over 700,000 vulnerable routers and cameras, enabling DDoS attacks reaching up to 30 terabits per second. As global internet providers struggled to mitigate these waves, Aisuru’s operators began renting bot-infected devices as residential proxies, granting cybercriminals more effective means to anonymize web scraping, credential stuffing, and data harvesting operations. This incident marks a significant escalation in how botnets are monetized, as botnet-powered residential proxies become a key enabler for content scraping—especially by AI firms seeking vast datasets. The pivot highlights a rising convergence between traditional cybercrime and emerging AI-driven abuse, challenging defenders to address both volumetric attack trends and subtle, persistent data exfiltration.
6 months ago
Kill Chain
AI-Powered Social Engineering Attacks Surge Across Africa in 2024
In early 2024, a surge of AI-powered social engineering attacks swept across Africa, targeting both government agencies and private enterprises. Threat actors utilized AI-generated phishing campaigns, deepfake technology, and sophisticated impersonation tactics to gain unauthorized access to sensitive systems and data. The attackers rapidly evolved their techniques by testing them in diverse African markets, often bypassing conventional security controls using realistic AI-driven lures and voice/video spoofing. The outcome included data breaches, operational interruptions, increased fraud, and reputational harm to affected organizations, while also exposing gaps in detection and response capabilities. This incident highlights the accelerating adoption of AI by cybercriminals, who now leverage machine learning to refine attack vectors and increase success rates. As similar TTPs proliferate globally, organizations face heightened regulatory scrutiny and must rapidly adapt cybersecurity frameworks to counter increasingly intelligent and deceptive threats.
6 months ago
Kill Chain
How Botnets Exploited Cloud Flaws in 2024: A Modern Security Wake-Up Call
In early 2024, security researchers observed an escalating wave of activity from botnets such as Mirai, leveraging vulnerabilities and misconfigurations across cloud environments and Internet-exposed assets. Attackers targeted PHP servers, IoT devices, and cloud gateways, exploiting both known flaws and weak security controls. Once compromised, these assets were co-opted into large-scale botnets used for distributed denial-of-service (DDoS) attacks, cryptomining, and lateral movement into business networks. The campaign underscored gaps in east-west traffic visibility, workload segmentation, and egress filtering, significantly increasing operational and reputational risk for enterprises. This incident is part of a growing trend where botnets and automated threat actors shift focus to cloud and hybrid environments, capitalizing on common misconfigurations. Organizations face mounting pressure to modernize defenses, as attackers rapidly adapt to evolving architectures and compliance expectations.
6 months ago
Kill Chain
Nation-State Supply Chain Attack: Airstalk Malware Targets AirWatch API in 2024
In June 2024, security researchers uncovered a sophisticated supply chain attack leveraging a new Windows-based malware dubbed "Airstalk." This campaign, attributed to a suspected nation-state threat actor, involved the misuse of the AirWatch API to exfiltrate sensitive browser data from targeted organizations. Attackers infiltrated the software ecosystem, enabling wide-scale distribution without initial detection. The breach highlighted the attackers' advanced techniques, including API abuse, stealthy data exfiltration, and lateral movement, severely impacting digital supply chains and putting both direct victims and downstream customers at risk. Airstalk exemplifies the growing threat posed by supply chain attacks, where trusted software platforms may be subverted for espionage or data theft. The attack underscores an urgent industry need for robust east-west traffic controls, zero trust segmentation, and continuous anomaly detection to mitigate evolving adversary tactics targeting critical infrastructure.
6 months ago
Kill Chain
OpenAI Atlas Browser Exposed: LLM Cloaking and Security Weaknesses in 2024
In early 2024, security researchers at SPLX and LayerX exposed significant vulnerabilities in OpenAI’s ChatGPT Atlas browser agent and similar AI-powered web agents. Through cloaking techniques, malicious actors can serve manipulated web content specifically to AI crawlers by altering the user-agent header, causing the agent to process misleading information while human users see normal content. This opens doors for smear campaigns, scam promotions, and manipulation of automated tasks like recruitment screening. Additional flaws in Atlas were discovered, including weak OAuth token storage and susceptibility to memory corruption exploits, raising serious concerns for business and consumer users. These vulnerabilities highlight the pressing need for AI governance and protection as adoption accelerates, with compliance and supply chain risk in sharp focus. With the rapid growth of generative AI in enterprise settings and lagging regulatory frameworks, businesses face mounting risks tied to both intentional adversarial content and platform design oversights.
6 months ago
Kill Chain
TEE.Fail Side-Channel Attack Exposes Flaws in Confidential Computing Across Intel, AMD, and NVIDIA CPUs
In early 2024, researchers uncovered a novel hardware vulnerability named TEE.Fail, capable of extracting cryptographic secrets from the trusted execution environments (TEEs) of major CPUs, including Intel SGX/TDX, AMD SEV-SNP, and NVIDIA H100. Exploiting side-channel flaws in the hardware design, attackers could bypass the isolated security boundary provided by TEEs, accessing sensitive data once thought to be well-protected. No evidence of attacks in the wild has surfaced, but proof-of-concept exploitation demonstrates wide-ranging risk for cloud providers and enterprises relying on confidential computing for regulatory compliance and sensitive workloads. The TEE.Fail disclosure highlights a growing trend of advanced research targeting the hardware roots of modern security. As organizations adopt confidential computing to strengthen privacy and regulatory posture, attackers may increasingly seek to exploit hardware and microarchitecture flaws beyond conventional software vulnerabilities.
6 months ago
Kill Chain
Inside the GhostCall & GhostHire Malware Campaigns: BlueNoroff’s 2025 Cryptocurrency Heists
In October 2025, cybersecurity researchers uncovered new attack chains, GhostCall and GhostHire, attributed to BlueNoroff—a sub-group of North Korea's Lazarus Group—targeting the Web3 and blockchain sectors. The campaigns form part of SnatchCrypto, an ongoing operation active since 2017, characterized by sophisticated spear-phishing, malware-laden documents, and social engineering tactics to infiltrate cryptocurrency firms and financial technology startups. Once initial access is gained, attackers deploy custom malware, bypass defenses, and ultimately exfiltrate sensitive data and digital assets, resulting in significant cryptocurrency thefts and disruption across targeted organizations. This campaign is especially concerning amid a surge of advanced persistent threats exploiting trust gaps in rapidly evolving blockchain and cryptocurrency environments. Regulators and cybersecurity teams are on high alert as major financial losses and reputational impacts drive urgency for improved controls, detection, and Zero Trust strategies.
6 months ago
Kill Chain
Memento Labs Leverages Chrome Zero-Day to Deploy LeetAgent Spyware in 2025
In March 2025, a critical zero-day vulnerability (CVE-2025-2783) in Google Chrome was exploited in the wild, enabling threat actors to escape the browser sandbox and deliver espionage-focused LeetAgent spyware attributed to Italian firm Memento Labs. Security researchers from Kaspersky identified targeted campaigns leveraging this flaw to compromise high-value victims via crafted web content, resulting in covert surveillance, data exfiltration, and unauthorized system access before Google patched the issue. This breach underscores the rapid weaponization of browser vulnerabilities by sophisticated actors to distribute espionage tools, often before defenders can respond. Incidents like this demonstrate an uptick in exploitation of high-impact zero-day flaws, especially in widely used software like Chrome, allowing elite cyber espionage operators to rapidly compromise organizations. The trend poses mounting risks as zero-days are increasingly used for targeted intrusions ahead of public disclosure and patch deployment.
6 months ago
Kill Chain
Atroposia RAT: How Turnkey Malware Is Changing Enterprise Threats in 2024
In early 2024, a sophisticated Remote Access Trojan (RAT) named Atroposia emerged for public sale on cybercrime forums, offering low-level attackers turnkey access to advanced capabilities such as persistent remote control, stealth, and evasion. Distributed as a ready-to-use toolkit, Atroposia enables affiliates to deploy the malware with minimal technical skill, significantly lowering the barrier to conducting targeted attacks against organizations. Key behaviors include encrypted communications, lateral movement, and data exfiltration, leveraging evasion techniques to bypass traditional security controls. The rapid adoption of Atroposia among threat actors increases operational risk for organizations lacking modern defenses. The prevalence of Atroposia highlights a growing trend in the cybercrime ecosystem: advanced malware-as-a-service platforms democratize sophisticated attacks, making high-impact breaches increasingly accessible. Enterprises face urgent pressure to modernize lateral movement controls, incident detection, and segmentation as attacker toolkits continue to evolve.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports