✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Computer Software/Engineering
Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.
Explore Other Sectors
Computer Software/Engineering Threat Reports
Kodak Data Breach 2026: ShinyHunters Extortion Group Claims Responsibility
In June 2026, Kodak confirmed a data breach after the ShinyHunters extortion group claimed responsibility for accessing over 2.2 million records containing customer personally identifiable information (PII) and internal corporate data. The attackers threatened to leak the exfiltrated data if their demands were not met by June 18, 2026. Kodak engaged external cybersecurity experts and law enforcement to investigate the incident and mitigate potential threats to their systems and operations. This incident underscores the escalating threat posed by cyber extortion groups like ShinyHunters, who have been linked to multiple high-profile data breaches in 2026, including attacks on Oracle PeopleSoft servers and various universities. Organizations must enhance their cybersecurity measures to protect sensitive data and prevent similar breaches.
1 month ago
Kill Chain
Crypto Clipper Campaign: A New Era of Cyber Deception
In June 2026, a sophisticated cyber campaign was uncovered wherein an unidentified threat actor utilized multiple platforms to distribute a Rust-based cryptocurrency clipboard hijacker targeting Windows and macOS users. The malware was disseminated through a dedicated WordPress phishing page, GitHub and SourceForge projects promoted by fake accounts, and a YouTube channel featuring AI-generated narrators. Additionally, the actor manipulated reputation systems by posting benign votes and "safe" comments on VirusTotal to misclassify the malicious files as harmless. This campaign highlights the evolving tactics of cybercriminals who exploit trust mechanisms across various platforms to deceive users into downloading malicious software. The use of AI-generated content and coordinated fake reviews underscores the need for heightened vigilance and advanced detection methods to combat such deceptive practices.
1 month ago
Kill Chain
Debate Erupts Over U.S. Ban on Anthropic's AI Models
In June 2026, the U.S. government issued an export control order restricting foreign nationals from accessing Anthropic's advanced AI models, Claude Fable 5 and Mythos 5, citing national security concerns. This led Anthropic to suspend the models' use for all customers to ensure compliance. The security community criticized the decision, arguing that it hampers defenders' access to crucial tools while doing little to prevent adversaries from developing similar capabilities. Experts highlighted that such restrictions might inadvertently accelerate the development of decentralized, open-source alternatives, potentially diminishing U.S. leadership in AI security. The incident underscores the delicate balance between national security and technological advancement, emphasizing the need for policies that support innovation while mitigating risks.
1 month ago
Kill Chain
Phantom Stealer: The Rise of Fileless Malware Targeting Financial Institutions
In June 2026, a sophisticated phishing campaign targeted banks and high-value organizations, deploying Phantom Stealer—a fileless malware designed to evade traditional endpoint defenses. The attack began with phishing emails containing seemingly legitimate business documents. Upon opening, a heavily obfuscated batch file initiated a multistage infection chain, injecting Phantom Stealer into the Windows Explorer process. Operating entirely in memory, the malware silently exfiltrated browser credentials, session cookies, and financial data through multiple channels, including Telegram, Discord, FTP, and SMTP. This incident underscores the evolving tactics of cybercriminals, highlighting the increasing use of fileless malware and advanced evasion techniques. Organizations must enhance their security posture by adopting behavior-based detection systems and educating employees on recognizing sophisticated phishing attempts to mitigate such threats.
1 month ago
Kill Chain
CISA Adds CVE-2026-48907 to Known Exploited Vulnerabilities Catalog
In June 2026, a critical vulnerability identified as CVE-2026-48907 was discovered in the Joomla Content Editor (JCE) extension, allowing unauthenticated attackers to create new editor profiles and upload arbitrary PHP code, leading to remote code execution. This flaw affects JCE versions prior to 2.9.99.5. The Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on June 16, 2026, following evidence of active exploitation. Joomla released patches on June 3 and June 6, 2026, to address this issue. ([securityweek.com](https://www.securityweek.com/joomla-litespeed-vulnerabilities-exploited-in-attacks/?utm_source=openai)) The active exploitation of CVE-2026-48907 underscores the persistent threat posed by web application vulnerabilities, particularly in widely used content management systems like Joomla. Organizations are urged to promptly apply the latest security updates to mitigate potential risks associated with this vulnerability.
1 month ago
Kill Chain
CISA Issues Warning on Actively Exploited Joomla JCE Vulnerability
In June 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a critical vulnerability, CVE-2026-48907, affecting the Joomla Content Editor (JCE) to its Known Exploited Vulnerabilities catalog. This flaw, present in JCE versions 1.0.0 through 2.9.99.4, allows unauthenticated users to create new editor profiles, enabling the upload and execution of arbitrary PHP code on the server. The vulnerability has been actively exploited, with attackers leveraging it to gain unauthorized access and control over affected Joomla installations. The active exploitation of this vulnerability underscores the persistent threat posed by improper access controls in widely used content management systems. Organizations utilizing Joomla with the JCE extension are urged to update to version 2.9.99.5 or later to mitigate this risk. Additionally, administrators should audit their systems for unauthorized editor profiles and monitor server logs for suspicious activity to prevent potential breaches.
1 month ago
Kill Chain
Mastra npm Supply Chain Attack: 144 Packages Compromised
In June 2026, a significant supply chain attack targeted the Mastra npm ecosystem, compromising 144 packages associated with the '@mastra' namespace. The attack was initiated through the hijacking of a former contributor's npm account, 'ehindero'. The attackers introduced a malicious dependency named 'easy-day-js', which masqueraded as the legitimate 'dayjs' library. Initially, 'easy-day-js' appeared benign, but subsequent versions contained obfuscated post-install scripts designed to exfiltrate sensitive information from developers' systems. This incident underscores the vulnerabilities inherent in open-source software supply chains, particularly when trusted contributor accounts are compromised. The Mastra framework, widely used for building AI applications, saw its core components, such as '@mastra/core', affected, amplifying the potential impact on downstream projects and organizations. The attack highlights the critical need for robust security measures in package management and dependency verification processes. The increasing frequency of such supply chain attacks emphasizes the urgency for the developer community to adopt stringent security practices, including regular audits of dependencies, implementation of multi-factor authentication for contributor accounts, and continuous monitoring for anomalous activities within software ecosystems.
1 month ago
Kill Chain
Malicious JetBrains Plugins Compromise AI API Keys in 2026
In June 2026, cybersecurity researchers identified a coordinated malware campaign involving at least 15 malicious plugins on the JetBrains Marketplace. These plugins, masquerading as AI coding assistants built on DeepSeek and other large language models, were designed to exfiltrate artificial intelligence (AI) provider keys. The plugins offered functionalities such as chat, commit messages, code review, bug finding, and unit tests, thereby enticing developers to install them. Once installed, the plugins covertly transmitted sensitive API keys to attacker-controlled servers, potentially compromising the security of AI-driven applications and services. This incident underscores a growing trend where threat actors exploit the trust in developer tools and marketplaces to distribute malicious software. The increasing integration of AI into development workflows makes such platforms attractive targets. Organizations must remain vigilant, ensuring the integrity of the tools they incorporate and regularly auditing their development environments to prevent unauthorized access and data exfiltration.
1 month ago
Kill Chain
Critical cPanel Plugin Vulnerability (CVE-2026-48172) Actively Exploited
In May 2026, a critical privilege escalation vulnerability (CVE-2026-48172) was discovered in the LiteSpeed User-End cPanel Plugin versions prior to 2.4.5. This flaw allows authenticated cPanel users to execute arbitrary scripts with root privileges by exploiting the 'lsws.redisAble' function. The vulnerability has been actively exploited in the wild, leading to full system compromises on affected shared hosting servers. LiteSpeed released patches in May 2026, urging users to update to version 2.4.7 or later to mitigate the risk. The active exploitation of this vulnerability underscores the persistent threat posed by privilege escalation flaws in widely used web hosting platforms. Organizations must prioritize timely patching and implement robust monitoring to detect and prevent unauthorized access, especially in shared hosting environments where a single compromised account can jeopardize the entire server.
1 month ago
Kill Chain
GhostTree Attack: Exploiting NTFS Junctions to Evade Detection
In May 2026, Varonis Threat Labs identified a novel evasion technique named 'GhostTree' that exploits NTFS junctions in Windows systems. By creating recursive directory loops, attackers can generate an effectively infinite number of file paths, causing Endpoint Detection and Response (EDR) tools to hang during recursive scans. This manipulation allows malicious files to remain undetected, as the scanning process becomes trapped in the loop and fails to complete. The technique requires only standard user permissions, making it accessible without administrative rights. ([varonis.com](https://www.varonis.com/blog/ghosttree-ntfs-trick?utm_source=openai)) The discovery of GhostTree underscores the evolving sophistication of malware evasion tactics. As attackers increasingly exploit legitimate system features to bypass security measures, organizations must enhance their detection capabilities and adopt comprehensive monitoring strategies to identify and mitigate such advanced threats.
1 month ago
Kill Chain
Malicious JetBrains Plugins Compromise Developer API Keys
In June 2026, Aikido Security uncovered a coordinated malware campaign involving at least 15 malicious plugins on the JetBrains Marketplace. These plugins, masquerading as AI coding assistants and Git utilities, were designed to steal AI API keys from developers. Upon users entering their API keys and clicking 'Apply,' the credentials were transmitted to a hardcoded server controlled by the attackers. The plugins, published under seven vendor accounts since October 2025, amassed nearly 70,000 installations. Notably, some plugins offered a paid tier, potentially redistributing stolen API keys to paying users. This incident underscores the escalating threat of supply chain attacks targeting developer ecosystems. As AI-powered tools become integral to software development, malicious actors are increasingly exploiting trusted platforms to distribute credential-stealing malware, highlighting the need for enhanced vigilance and security measures within developer communities.
1 month ago
Kill Chain
Malware Campaign Targets Steam Users via Wallpaper Engine
In June 2026, cybersecurity researchers uncovered a campaign where threat actors exploited Steam Workshop and the Wallpaper Engine application to distribute malware. Malicious actors uploaded infected wallpaper packages to Steam Workshop, which, when installed via Wallpaper Engine, executed payloads leading to Steam account hijacking, system backdoors, or cryptomining operations. This campaign primarily targeted users in China and Russia but also affected individuals in Singapore, Hong Kong, Germany, Vietnam, India, and Canada. The malware was often concealed within password-protected archives or bundled directly in the wallpaper packages, executing automatically upon installation. This incident underscores the evolving tactics of cybercriminals who leverage trusted platforms and user-generated content to disseminate malware. The exploitation of application wallpapers highlights the need for enhanced scrutiny of community-driven content and the importance of robust security measures to detect and prevent such sophisticated attacks.
1 month ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports