✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Computer Software/Engineering
Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.
Explore Other Sectors
Computer Software/Engineering Threat Reports
Understanding the 'Cordyceps' Vulnerability: A Threat to CI/CD Workflows
In June 2026, a critical vulnerability named 'Cordyceps' was identified, affecting Continuous Integration and Continuous Deployment (CI/CD) workflows across major platforms including Microsoft's Azure Sentinel, Google's AI Agent Development Kit, Apache's Doris analytics database, Cloudflare's Workers SDK, and the Python Software Foundation's Black. This flaw allows unauthenticated attackers to exploit automated workflows via malicious pull requests, potentially leading to command injection, privilege escalation, and full control over affected repositories. The attack vector leverages the inherent trust in pull requests and the automated processes that handle them, exposing millions of repositories to potential hijacking. ([darkreading.com](https://www.darkreading.com/application-security/cordyceps-malicious-pull-requests-developer-workflows?utm_source=openai)) The discovery of 'Cordyceps' underscores the escalating risks within software supply chains, particularly as agentic coding practices proliferate, reproducing insecure patterns across numerous repositories. Organizations are urged to audit and secure their CI/CD configurations to prevent unauthorized access and mitigate the risk of supply chain compromises.
1 month ago
Kill Chain
Malicious OpenClaw Skills Threaten AI Supply Chain
In June 2026, security researchers identified five malicious skills on ClawHub, OpenClaw's dedicated marketplace, that could steal credentials, bypass security scans, and perform other malicious activities for financial gain. These skills, appearing legitimate, demonstrated that such platforms are emerging as significant AI supply chain attack surfaces. ClawHub sells these skills to add functionality to the open-source AI agent, which has seen rapid adoption among developers and businesses since its launch last November. The malicious skills included infostealers targeting macOS, evasion techniques using inflated file sizes to bypass detection, and agentic threats like affiliate injection and front-running, all posing significant risks to organizations using OpenClaw. ([darkreading.com](https://www.darkreading.com/cyber-risk/malicious-openclaw-skills-clawhub-threaten-ai-supply-chain?utm_source=openai)) This incident underscores the growing threat of supply chain attacks within AI ecosystems, highlighting the need for rigorous verification frameworks and continuous monitoring of third-party extensions to prevent unauthorized access and data exfiltration.
1 month ago
Kill Chain
Critical macOS Vulnerability Allows Disabling of Security Tools Without Admin Credentials
In June 2026, researchers at XM Cyber identified a macOS vulnerability that allows users with standard privileges to disable enterprise security tools and execute privileged functions without administrator credentials. This flaw exploits how macOS establishes and validates application trust information, enabling attackers to impersonate trusted application components and perform actions reserved for privileged processes. The technique was demonstrated to disable CrowdStrike Falcon Endpoint Detection and Response (EDR) and Kandji Mobile Device Management (MDM) without triggering alerts or requiring kernel exploits. The issue potentially affects other macOS applications that provide privileged Cross-Process Communication (XPC) services and rely on Apple's CDHash for verifying application authenticity. XM Cyber plans to release an open-source tool named XPC Hunter at Black Hat USA in August to help security researchers identify similar vulnerabilities across macOS applications. Apple has been notified but has not responded at press time. This vulnerability underscores the need for organizations to reassess their macOS security configurations and implement additional safeguards to prevent unauthorized access and manipulation of security tools.
1 month ago
Kill Chain
DoJ Seizes Huione Cloud Account Tied to Cyber Scam Money Laundering
In June 2026, the U.S. Department of Justice seized a cloud computing account utilized by subsidiaries of Cambodia-based Huione Group. This infrastructure supported Huione Guarantee, a Telegram-based marketplace facilitating the laundering of billions in cryptocurrency obtained through investment frauds and cyber scams. The platform offered services such as money laundering, sale of stolen personal data, and tools for fraudulent activities, enabling the conversion of illicit proceeds into the legitimate banking system undetected. This action underscores the escalating global efforts to dismantle sophisticated cybercriminal networks exploiting digital platforms for large-scale financial crimes. The seizure highlights the critical need for robust cybersecurity measures and vigilant monitoring of online marketplaces to prevent the proliferation of such illicit activities.
1 month ago
Kill Chain
OpenClaw AI Supply Chain Attack: A Wake-Up Call for AI Security
In early 2026, the OpenClaw AI agent ecosystem experienced a significant supply chain attack. Malicious actors uploaded over 800 compromised skills to ClawHub, OpenClaw's official skill marketplace, embedding infostealers and enabling agentic financial fraud. This breach exposed more than 135,000 instances, highlighting critical vulnerabilities in AI agent platforms. The incident underscores the urgent need for enhanced security measures in AI supply chains, as attackers increasingly exploit these platforms to distribute malware and conduct sophisticated cyber operations.
1 month ago
Kill Chain
Cordyceps Vulnerabilities Threaten Over 300 GitHub Repositories
In June 2026, cybersecurity firm Novee identified a systemic class of vulnerabilities, dubbed 'Cordyceps,' within GitHub Actions workflows. These flaws enable unauthenticated attackers to hijack continuous integration and continuous deployment (CI/CD) pipelines by exploiting insecure configurations in YAML files. The vulnerabilities affect repositories from major organizations, including Microsoft, Google, Apache, Cloudflare, and the Python Software Foundation, potentially compromising software supply chains and exposing sensitive credentials. ([securityweek.com](https://www.securityweek.com/exploitable-ci-cd-vulnerabilities-expose-millions-of-repositories-to-hijacking/?utm_source=openai)) This incident underscores the escalating risks associated with CI/CD pipeline security, especially as AI-driven coding tools proliferate. Organizations must prioritize securing their development workflows to prevent similar supply chain attacks, which are becoming increasingly sophisticated and widespread. ([mallory.ai](https://www.mallory.ai/stories/019ef4cf-b141-7c22-b785-3b7e99e1c73f?utm_source=openai))
1 month ago
Kill Chain
Microsoft and Partners Execute Unprecedented Takedown of Amadey and StealC Cybercrime Tools
In June 2026, Microsoft, in collaboration with international law enforcement agencies and industry partners, executed a court-authorized operation to simultaneously disrupt the Amadey botnet and StealC infostealer. These tools, often used in tandem by cybercriminals, were linked to over 140,000 infected computers globally in early May 2026. The operation targeted more than 200 command-and-control servers, significantly hindering the infrastructure supporting these malware families. This coordinated effort marked a strategic shift in cyber defense, emphasizing the importance of disrupting interconnected cybercrime tools to enhance the effectiveness of takedown operations. The success of this operation underscores the necessity for collaborative approaches in combating sophisticated cyber threats that exploit modular, pay-as-you-go models to escalate attacks rapidly.
1 month ago
Kill Chain
LastPass Data Breach via Klue Supply Chain Attack in 2026
In June 2026, LastPass experienced a data breach resulting from a supply chain attack on Klue, a third-party market intelligence platform integrated with LastPass's Salesforce environment. Attackers exploited compromised OAuth tokens obtained from Klue to access LastPass customer data, including names, phone numbers, email addresses, physical addresses, support case information, and sales-related data. Importantly, LastPass's core products, services, and customer vaults remained unaffected. ([blog.lastpass.com](https://blog.lastpass.com/posts/klue-supply-chain-incident-and-lastpass-response?utm_source=openai)) This incident underscores the escalating risks associated with third-party integrations and supply chain vulnerabilities. Organizations must reassess their security postures, particularly concerning external partnerships, to mitigate potential threats arising from interconnected systems.
1 month ago
Kill Chain
New macOS ClickFix Attack Silently Mounts DMGs to Deploy Infostealer
In June 2026, a new macOS ClickFix campaign emerged, utilizing Terminal commands to silently download, mount, and execute info-stealing malware from malicious disk image (DMG) files. This attack infects Mac devices with the Atomic macOS Stealer (AMOS), which exfiltrates browser credentials, cryptocurrency wallet data, Keychain information, messaging app data, and user documents. The campaign begins with a fake CAPTCHA page instructing users to open Terminal and paste a malicious command, leading to the automatic execution of the malware. This method represents an evolution in ClickFix attacks, combining social engineering with automated malware deployment to enhance stealth and effectiveness. The significance of this incident lies in the increasing sophistication of social engineering attacks targeting macOS users. By leveraging trusted system utilities and deceptive prompts, attackers can bypass traditional security measures and user vigilance. This trend underscores the need for enhanced user education, robust endpoint protection, and continuous monitoring to detect and mitigate such evolving threats.
1 month ago
Kill Chain
Xsolis Data Breach 2026: A Wake-Up Call for Healthcare Cybersecurity
In January 2026, healthcare technology company Xsolis experienced a data breach affecting nearly 1.4 million individuals. The breach resulted from a targeted phishing attack on January 20, 2026, which allowed unauthorized access to Xsolis's network. The attackers accessed files containing sensitive personal and health information, including names, addresses, dates of birth, Social Security numbers, health insurance details, and medical treatment information. Xsolis detected the unauthorized activity on January 22, 2026, promptly contained the breach, and initiated an investigation with external cybersecurity experts. The company has since notified affected individuals and implemented additional security measures to prevent future incidents. This incident underscores the persistent threat of phishing attacks in the healthcare sector, highlighting the critical need for robust cybersecurity measures and employee training to protect sensitive patient data. The breach also raises concerns about potential identity theft and fraud for the affected individuals, emphasizing the importance of vigilance and proactive monitoring of personal information.
1 month ago
Kill Chain
Malicious npm Packages Masquerade as PostCSS Tools to Deploy Windows RAT
In June 2026, cybersecurity researchers identified a series of malicious npm packages masquerading as legitimate PostCSS tools. These packages, including 'aes-decode-runner-pro', 'postcss-minify-selector', and 'postcss-minify-selector-parser', were designed to deliver a Windows-based Remote Access Trojan (RAT) upon installation. The packages were published over the past month by an npm user named 'abdrizak'. The malicious code was heavily obfuscated, leveraging techniques like Base64 and XOR encoding, as well as minification, to resist analysis and detection efforts. Upon installation, the packages retrieved a malicious script from a remote server, executing it silently to deploy the RAT on Windows systems. ([research.jfrog.com](https://research.jfrog.com/post/from-postcss-typosquat-to-windows-rat/?utm_source=openai)) This incident underscores the persistent threat of supply chain attacks within the npm ecosystem. Attackers continue to exploit the trust in widely used open-source packages to distribute malware, highlighting the need for enhanced vigilance and security measures among developers and organizations.
1 month ago
Kill Chain
AIR's Experiment Unveils Critical Security Gaps in AI Agent Skill Marketplaces
In June 2026, security firm AIR conducted an experiment to highlight vulnerabilities in AI agent skill marketplaces. They created a fake AI agent skill named 'brand-landingpage,' which purported to assist users in building landing pages using Google's Stitch design tool. This skill was submitted to a popular skill marketplace and promoted via an Instagram ad, ultimately reaching approximately 26,000 agents, including those on corporate accounts. Notably, all security scanners tested by AIR marked the skill as safe. The payload was intentionally benign, merely collecting users' email addresses to demonstrate the ease with which malicious skills could bypass existing security measures. This incident underscores the pressing need for enhanced security protocols in AI agent skill ecosystems, as traditional trust signals such as GitHub stars and scanner verdicts proved insufficient in detecting potential threats. The reliance on external links within skills, which can be altered post-review, presents a significant risk, emphasizing the necessity for continuous monitoring and comprehensive vetting processes to safeguard against supply chain attacks in AI environments.
1 month ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports