✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Computer Software/Engineering
Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.
Explore Other Sectors
Computer Software/Engineering Threat Reports
Cursor & Windsurf IDEs Hit by 94+ Chromium Vulnerabilities – Supply-Chain Exposure in 2024
In early 2024, security researchers identified that the latest releases of the Cursor and Windsurf integrated development environments (IDEs) were vulnerable to over 94 known and patched security vulnerabilities within the embedded Chromium browser and V8 JavaScript engine. These n-day vulnerabilities exist because the IDEs relied on outdated Chromium builds, exposing users to a range of critical issues, including remote code execution, privilege escalation, and data leakage. The supply-chain nature of the incident means development teams using these IDEs could inadvertently introduce risk across their entire workflow and environments. This incident underscores the persistent risk posed by vulnerable software dependencies and highlights an urgent need for improved supply-chain security. With attackers increasingly targeting development tools for initial access or lateral movement, organizations must re-evaluate their patch management, vendor risk assessments, and layered network protections.
6 months ago
Kill Chain
North Korean Hackers Employ EtherHiding for Unprecedented Cryptocurrency Heist
In October 2025, threat group UNC5342—attributed to North Korea—executed an advanced cryptocurrency theft operation by leveraging the novel EtherHiding technique. Attackers embedded malicious code within blockchain smart contracts to distribute malware, evading conventional detection mechanisms. Google Threat Intelligence Group (GTIG) identified this as the first known use of EtherHiding by a state-sponsored actor, resulting in the covert compromise of multiple cryptocurrency platforms and significant asset loss. The incident underscores an evolving trend: nation-state actors are adopting increasingly sophisticated blockchain-based attack methods. With rising blockchain adoption, such TTPs present serious risks for organizations involved in digital assets, regulation, and financial technology.
6 months ago
Kill Chain
North Korean APT Combines BeaverTail and OtterCookie in Major 2025 JS Malware Campaign
In October 2025, a North Korean state-sponsored hacking group with ties to the Contagious Interview campaign was observed integrating features from its BeaverTail and OtterCookie malware into a sophisticated new JavaScript-based attack. Security research from Cisco Talos revealed the group’s evolving approach: combining credential theft, evasion, and persistent access in targeted spear-phishing campaigns directed at global enterprises, which enabled stealthy lateral movement and prolonged network compromise. Analysis showed that this fusion malware increased the attackers’ efficiency and resilience, leading to significant data exposure risks and operational disruptions for affected organizations. This incident highlights a broader trend—North Korean APTs are rapidly developing multipurpose malware platforms capable of bypassing traditional defenses. The blending of well-established tools signals a new level of technical maturity, raising the urgency for organizations to shore up east-west traffic security, zero trust segmentation, and advanced threat detection controls.
6 months ago
Kill Chain
New CAPI Backdoor Targets Russian Auto & E-Commerce with Phishing ZIPs
In October 2025, cybersecurity researchers uncovered a sophisticated phishing campaign targeting Russian automobile and e-commerce firms. The attackers distributed phishing emails containing malicious ZIP files, which, when opened, triggered the deployment of a never-before-seen .NET-based malware known as the CAPI Backdoor. Once installed, the malware established persistent access, enabling threat actors to conduct internal network reconnaissance, exfiltrate sensitive information, and potentially disrupt business operations. Seqrite Labs, who analyzed the activity, report that the campaign’s execution appears highly tailored to exploit Russia’s rapidly digitizing sectors. This incident is significant amid a sharp increase in spear phishing and backdoor campaigns against supply chain and commercial organizations across Eastern Europe. The novelty of the CAPI Backdoor highlights evolving attacker sophistication and amplifies regulatory attention around encrypted traffic inspection, zero trust, and rapid anomaly detection.
6 months ago
Kill Chain
131 Chrome Extensions Hijack WhatsApp Web: The 2025 Brazilian Spam Campaign
In October 2025, a coordinated cyberattack was uncovered where 131 malicious Chrome browser extensions—clones of a popular WhatsApp Web automation tool—were used to hijack users’ sessions and launch an automated spam campaign targeting Brazilian users. Researchers from security company Socket found that these plugins, sharing an identical codebase and infrastructure, infected over 20,000 users by enticing them to install seemingly legitimate add-ons, enabling attackers to take control of browser sessions, inject spam messages, and exfiltrate private data at scale. The incident underscores the risks associated with browser extension supply chain threats, exposing enterprises and individuals to large-scale account compromise and privacy breaches. This breach is particularly significant as it demonstrates the adaptability and persistence of threat actors in abusing browser supply routes and leveraging rebranded extensions to evade traditional security controls. The campaign’s targeting of WhatsApp Web also signals a shift toward exploiting widely-used communication channels for coordinated spam and fraud, spotlighting the critical need for proactive browser extension vetting and user awareness.
6 months ago
Kill Chain
Inside the Synthient Stealer Log Threat Data: 2025's Monumental Infostealer Breach
In late 2025, a vast dataset known as the 'Synthient Stealer Log Threat Data' surfaced, aggregating over 3.5 terabytes and 23 billion rows of stolen credentials and website entries collected from infostealer malware and credential stuffing campaigns. This dataset comprised logs exfiltrated via platforms like Telegram, social media, and dark web forums, predominantly sourced from malware-infected endpoints. Analysis revealed 183 million unique email addresses, with over 8% never before seen in data breach collections, confirming both scale and uniqueness. The data's authenticity was validated through subscriber checks and corroborating evidence from exposed accounts. This incident underscores the escalating risks posed by mass infostealer malware campaigns, highlighting their ability to industrialize credential theft and rapidly distribute sensitive personal data. As attackers continuously refine malware arsenals and leverage broader distribution networks, organizations and individuals must act urgently to address credential reuse, enhance detection, and mitigate lateral movement threats.
6 months ago
Kill Chain
US Court Bars NSO Group from Targeting WhatsApp Users with Spyware
In June 2024, a U.S. federal judge issued a permanent injunction against NSO Group, prohibiting the Israeli spyware developer from targeting WhatsApp users with its surveillance products. The case originated from a 2019 incident in which NSO Group exploited flaws in WhatsApp's messaging platform to compromise user privacy, prompting Meta (WhatsApp's parent company) to launch a protracted legal battle. The court recognized the significant risk posed to Meta's business and user trust, as WhatsApp's core value proposition is secure, end-to-end encrypted communications. The injunction was coupled with a major reduction in damages, from $167.3 million to $4 million, marking a significant legal precedent in the spyware industry. This decision highlights mounting regulatory and legal scrutiny on commercial spyware vendors and underscores the increasing stakes for companies offering encrypted services. The ruling signals judicial awareness of privacy threats from advanced surveillance tools and may embolden similar litigation or policy action worldwide.
6 months ago
Kill Chain
GlassWorm Supply Chain Malware: VS Code & OpenVSX Infected in 2025
In October 2025, a highly sophisticated supply chain attack involving the GlassWorm malware targeted developers via the OpenVSX and Microsoft Visual Studio Code (VS Code) extension marketplaces. Malicious actors inserted invisible Unicode characters into multiple popular extensions, enabling self-spreading malware to infect users without detection during automatic updates. GlassWorm stole credentials for developer services and cryptocurrency wallets, established remote access, and transformed compromised workstations into nodes within a broader criminal infrastructure. The malware leveraged blockchain (Solana) transactions, Google Calendar events, and distributed Peer-to-Peer protocols for resilient command-and-control, impacting at least 35,800 installations and keeping several malicious extensions available before remediation. This incident highlights the growing threat of self-propagating malware in software supply chains, especially via extension ecosystems critical to development workflows. Its combination of advanced evasion tactics, automated propagation, and leveraging of decentralized infrastructure sets a new precedent, signaling broader risks for organizations relying on trusted code repositories and accelerating regulatory and industry scrutiny on supply chain security.
6 months ago
Kill Chain
Linux Fileless Malware in 2024: Syscall(memfd_create) Unlocks New Attack Vectors
In October 2024, security researchers discovered a new Linux-targeting fileless malware that exploits Python and the direct use of syscalls—specifically 'memfd_create'—to execute payloads entirely in memory, bypassing traditional disk-based detection. The attack begins with a Python dropper embedding a base64-encoded ELF binary, which is loaded directly into memory using syscall(319), then executes file encryption using a simple 1-byte XOR key. While the second stage payload is rudimentary and appears to be a proof-of-concept, the methodology demonstrates how easily threat actors can evade filesystem-based controls and endpoint security tools on Linux systems. The incident underscores an increasing trend in fileless malware and direct syscall manipulation, especially on Linux servers and cloud workloads. These advanced tactics make traditional detection and prevention approaches less effective, urging organizations to adopt stronger memory and process monitoring, inline threat detection, and zero-trust segmentation to mitigate similar threats.
6 months ago
Kill Chain
Agentic AI's OODA Loop Vulnerability: Prompt Injection & Architecture Risks in 2025
In October 2025, a major vulnerability was revealed in agentic AI systems’ OODA (Observe, Orient, Decide, Act) decision loops, where adversaries exploited prompt injection, training data poisoning, and tool protocol confusion to compromise autonomous AI agents. Attackers planted triggers and malicious instructions in web-accessible content and tool descriptions, which were ingested by AI models, bypassing privilege separation and contaminating operational state and chat history. The incident resulted in persistent data leaks, unintentional tool actions, and the propagation of backdoors and compromised context across organizations deploying AI-driven automation and analytics. This exposure underscores a critical and growing risk: as organizations adopt increasingly autonomous AI, vulnerabilities related to data integrity, input trust, and OODA loop manipulation have escalated. Recent trends show surges in prompt injection exploits, AI-powered toolchain attacks, and regulatory focus on AI integrity controls, highlighting an urgent need for architectural reforms and robust zero trust measures.
6 months ago
Kill Chain
TikTok-Delivered Infostealer: ClickFix Campaign Compromises Credentials
In October 2025, a widespread campaign leveraged TikTok videos masquerading as free activation guides for popular software titles—including Windows, Adobe products, and Spotify—to distribute information-stealing malware. Attackers used "ClickFix" social engineering to instruct viewers to run obfuscated PowerShell commands, delivering the Aura Stealer infostealer and an additional payload via Cloudflare-hosted executables. The attack enabled threat actors to harvest browser credentials, authentication cookies, and wallet data from victims, leading to high risk of account compromise and data theft. Infection occurred after users were tricked into executing single-line commands under the guise of software activation or fixes. This incident highlights the increasing weaponization of social media platforms as initial access vectors for malware and demonstrates the growing sophistication of infostealer campaigns. The trend underscores the urgent need for organizations to address social engineering risks and update awareness programs as attackers rapidly innovate their distribution methods.
6 months ago
Kill Chain
Fake Homebrew and LogMeIn Sites Spread Infostealer Malware via Google Ads in 2025
In October 2025, a sophisticated malvertising campaign exploited Google Ads to distribute infostealing malware via fake Homebrew, LogMeIn, and TradingView websites targeting macOS users and developers. The threat actors registered over 85 convincing domains and lured victims to enter terminal commands that downloaded malware such as AMOS (Atomic macOS Stealer) and Odyssey Stealer. Once executed, these payloads bypassed security controls, harvested browser credentials, cryptocurrency wallets, and sensitive files, and forwarded the stolen data to threat actor-controlled servers. This campaign underscores the effectiveness of ClickFix social engineering techniques and highlights the risks of trust in search advertising. The incident is particularly relevant as infostealer malware continues to evolve with new tactics, including sophisticated social engineering, supply chain targeting, and persistent access capabilities. Organizations face increasing pressure to defend against rapidly shifting malware delivery channels and enforce user education to reduce the likelihood of compromise.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports