✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Computer Software/Engineering
Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.
Explore Other Sectors
Computer Software/Engineering Threat Reports
OXLOADER Exploits Google Ads to Distribute CastleStealer Malware
In June 2026, cybersecurity researchers identified a new malware loader named OXLOADER, which is being used to distribute the CastleStealer infostealer. The campaign begins with malicious Google Ads that redirect users searching for 'lts version of node.js' to a counterfeit website. This site delivers a batch script hosted on Storj, which, when executed, downloads and runs OXLOADER. OXLOADER employs advanced obfuscation techniques and anti-analysis measures to evade detection, ultimately deploying CastleStealer to exfiltrate sensitive information from infected systems. This incident underscores the evolving tactics of threat actors who exploit legitimate services like Google Ads and Storj to distribute malware. The sophisticated obfuscation and anti-analysis methods used by OXLOADER highlight the increasing complexity of malware designed to bypass traditional security measures, posing significant challenges for detection and mitigation.
1 month ago
Kill Chain
Mastra AI Supply Chain Attack: A Wake-Up Call for Software Security
In June 2026, Microsoft identified a significant supply chain attack targeting the Mastra AI ecosystem, attributed to the North Korean state-sponsored group Sapphire Sleet (also known as BlueNoroff). The attackers compromised an npm maintainer account, 'ehindero,' with publishing privileges across the Mastra package environment. They published malicious updates for over 140 packages within the @mastra scope, introducing a malicious dependency named 'easy-day-js,' a typosquat of the legitimate 'dayjs' JavaScript library. Upon installation, this dependency executed a post-install hook deploying a malware dropper on developers' devices, aiming to steal sensitive credentials, API keys, authentication tokens, and cryptocurrency wallets. The second-stage payload was a cross-platform information stealer designed to target Windows, Linux, and macOS systems, collecting host information, browser histories, installed applications, running processes, and checking for 166 cryptocurrency wallet browser extensions, including MetaMask, Phantom, Coinbase Wallet, Binance Wallet, and TronLink. The malware employed different persistence methods depending on the operating system, such as Windows Registry Run keys, macOS LaunchAgents, and Linux systemd services. Microsoft observed that systems communicating with the attackers' command-and-control servers exhibited follow-on activity consistent with Sapphire Sleet's previous campaigns, including the deployment of a PowerShell backdoor, additional persistence mechanisms, Microsoft Defender exclusions, and a malicious Windows service granting SYSTEM privileges. This incident underscores the evolving tactics of North Korean threat actors in targeting the software supply chain to facilitate credential theft and cryptocurrency asset exfiltration. Organizations are urged to enhance their supply chain security measures and remain vigilant against such sophisticated attacks.
1 month ago
Kill Chain
Critical Vulnerability in Gravity SMTP Plugin Exposes API Keys
In June 2026, a significant security vulnerability (CVE-2026-4020) was discovered in the Gravity SMTP WordPress plugin, affecting approximately 100,000 websites. This flaw allowed unauthenticated attackers to access sensitive information, including API keys and configuration data, through an improperly secured REST API endpoint. Exploitation of this vulnerability enabled threat actors to harvest credentials and gain insights into the site's software stack, potentially facilitating further attacks. The incident underscores the critical importance of promptly updating plugins and securing REST API endpoints to prevent unauthorized data exposure. It also highlights the need for website administrators to regularly audit and monitor their systems for vulnerabilities to mitigate the risk of exploitation.
1 month ago
Kill Chain
Understanding Device Code Phishing: The New Frontier in MFA Bypass
In early 2026, cybersecurity researchers identified a surge in phishing campaigns exploiting the OAuth 2.0 Device Authorization Grant flow to bypass multi-factor authentication (MFA). Attackers trick users into entering device codes on legitimate Microsoft authentication pages, granting unauthorized access to services like Outlook, OneDrive, and Teams without stealing credentials. This method allows persistent access, even after password resets, posing significant risks to organizations relying on traditional MFA for security. The proliferation of Phishing-as-a-Service platforms, such as Kali365, has lowered the technical barrier for cybercriminals, enabling large-scale exploitation of this technique. The FBI and Microsoft have issued warnings, emphasizing the need for organizations to implement conditional access policies, disable device code authentication where unnecessary, and adopt phishing-resistant MFA solutions to mitigate these evolving threats.
1 month ago
Kill Chain
Klue OAuth Breach 2026: Lessons in Third-Party Integration Security
In June 2026, Klue, a market intelligence platform, experienced a security breach where attackers exploited a compromised legacy credential to access Klue's integration infrastructure. This allowed them to steal OAuth tokens used to connect Klue with third-party platforms, notably Salesforce. Utilizing these tokens, the attackers accessed and exfiltrated data from multiple customer Salesforce environments. The incident was publicly claimed by the 'Icarus' extortion group, which pressured affected organizations to contact them to prevent the leaking of stolen data. This breach underscores the critical vulnerabilities associated with third-party integrations and the OAuth protocol. It highlights the necessity for organizations to rigorously monitor and manage third-party access, regularly audit integration credentials, and implement robust security measures to prevent unauthorized access through supply chain vectors.
1 month ago
Kill Chain
Critical Vulnerability in Gravity SMTP Plugin: CVE-2026-4020 Exploited
In June 2026, an unauthenticated information disclosure vulnerability (CVE-2026-4020) was discovered in the Gravity SMTP WordPress plugin, affecting versions up to 2.1.4. This flaw exposed sensitive data, including API keys, email service credentials, and system configuration details, to unauthenticated users via an improperly secured REST API endpoint. Exploitation of this vulnerability could lead to unauthorized access and control over affected websites. The incident underscores the critical importance of promptly updating plugins and implementing robust security measures to protect against emerging threats. Organizations must remain vigilant, as attackers continue to exploit such vulnerabilities to gain unauthorized access and compromise sensitive information.
1 month ago
Kill Chain
AutoJack Attack: A Wake-Up Call for AI Agent Security
In June 2026, Microsoft researchers disclosed a critical vulnerability named 'AutoJack' that allows a single web page to hijack AI browsing agents, leading to remote code execution on the host machine. By directing an AI agent to load a malicious web page, attackers can exploit JavaScript to interact with privileged local services, spawning unauthorized processes without requiring user credentials or further interaction. This exploit underscores the significant risks associated with AI agents' integration with web content and their elevated system privileges. The AutoJack attack highlights the growing trend of adversaries targeting AI development tools and agents. Similar incidents, such as the 'Agentjacking' attack, have demonstrated how AI coding agents can be manipulated into executing malicious code through crafted error reports. These developments emphasize the urgent need for robust security measures in AI agent design and deployment to prevent exploitation through prompt injections and other novel attack vectors.
1 month ago
Kill Chain
Novo Nordisk 2026 Breach: A Wake-Up Call for Software Development Security
In March 2026, Novo Nordisk, a leading pharmaceutical company, experienced a significant security breach initiated through an exposed GitHub personal access token found in client-side JavaScript on a subdomain. The threat group FulcrumSec exploited this token to clone private repositories, harvest additional credentials, and infiltrate deeper into the company's network. Over a span of more than two months, the attackers exfiltrated approximately 1.3TB of sensitive data, including source code, proprietary drug information, clinical trial data, internal AI models, and personal information of healthcare professionals and clinical trial participants. The breach was publicly disclosed on June 11, 2026, after unauthorized access to internal IT systems was detected. This incident highlights the critical vulnerabilities in software development pipelines, particularly concerning secrets management and the security of code repositories. The reliance on hardcoded credentials and improperly scoped access keys within development environments presents a substantial risk. Organizations are urged to treat development platforms as production systems, enforce stringent secrets management practices, and implement robust monitoring to prevent similar breaches.
1 month ago
Kill Chain
Salesforce Disables Klue App Integration Following OAuth Token Abuse Incident
In June 2026, Salesforce detected unauthorized access to customer data through the Klue Battlecards app integration. Threat actors exploited OAuth tokens associated with the app to gain access to sensitive information within Salesforce instances. Upon discovery, Salesforce promptly disabled the Klue app integration to prevent further data exposure and initiated a comprehensive investigation into the breach. This incident underscores the escalating threat posed by OAuth token abuse, a technique increasingly leveraged by cybercriminals to bypass traditional authentication mechanisms. Organizations must remain vigilant and implement robust security measures to safeguard against such sophisticated attacks.
1 month ago
Kill Chain
Operation Endgame: A Major Blow to SocGholish Malware Infrastructure
In June 2026, an international law enforcement coalition comprising agencies from the Netherlands, Canada, the United States, and Germany executed Operation Endgame, targeting the SocGholish malware infrastructure. This coordinated effort led to the takedown of 106 servers and the remediation of 14,971 WordPress websites infected with SocGholish, a JavaScript-based downloader malware. SocGholish, active since 2017, masquerades as browser updates to distribute additional malicious payloads, often leading to ransomware attacks orchestrated by groups like Evil Corp. The operation significantly disrupted the malware's distribution channels, mitigating further risks to global digital systems. ([politie.nl](https://www.politie.nl/en/news/2026/june/18/international-law-enforcement-initiate-hunt-on-malware-group-socgholish.html?utm_source=openai)) The success of Operation Endgame underscores the effectiveness of international collaboration in combating cyber threats. However, the persistent evolution of malware tactics necessitates continuous vigilance and adaptive cybersecurity measures. Organizations are urged to regularly update their systems, monitor for unauthorized access, and educate users about the dangers of deceptive software updates to prevent future infections.
1 month ago
Kill Chain
Anthropic's Fable 5 AI Model Suspended Amid National Security Concerns
In June 2026, Anthropic released its advanced AI model, Fable 5, designed to autonomously identify and exploit software vulnerabilities. Shortly after its release, the U.S. government classified Fable 5 as a potential national security threat, citing concerns over its capability to be 'jailbroken' and misused by malicious actors. Consequently, Anthropic was ordered to suspend access to the model for all foreign nationals, leading the company to disable Fable 5 entirely due to the inability to selectively restrict access. This abrupt shutdown has sparked significant debate within the cybersecurity community, with experts arguing that such restrictions may hinder defensive research more than deter malicious use. The incident underscores the challenges in balancing AI innovation with national security and the need for clear regulatory frameworks to manage the dual-use nature of advanced AI technologies.
1 month ago
Kill Chain
TeamPCP's Supply Chain Attacks: A Wake-Up Call for Open-Source Security
Between February and June 2026, the cybercriminal group TeamPCP executed a series of supply chain attacks, compromising over 1,000 open-source software packages. By infiltrating widely used tools such as Trivy, Checkmarx KICS, LiteLLM, and the Telnyx Python SDK, TeamPCP exploited vulnerabilities in CI/CD pipelines and AI development tools to inject malicious code, leading to the exfiltration of sensitive data and credentials. This campaign underscored the critical weaknesses in the software supply chain, particularly the reliance on unverified code dependencies and the lack of rigorous security checks in automated deployment systems. The incident highlights the urgent need for organizations to reassess their software development practices, emphasizing the importance of verifying the integrity of open-source components and implementing robust security measures within CI/CD pipelines. As supply chain attacks become more prevalent, the industry must prioritize security to prevent similar large-scale compromises in the future.
1 month ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports