✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Computer Software/Engineering
Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.
Explore Other Sectors
Computer Software/Engineering Threat Reports
WeedHack Malware Campaign Compromises Over 116,000 Minecraft Systems
In early 2026, a large-scale malware campaign named WeedHack targeted Minecraft players, infecting over 116,000 systems by June. The malware was disseminated through malicious Minecraft mods, clients, cheats, and utilities promoted via YouTube videos and SEO poisoning techniques. Once installed, WeedHack functioned as a malware-as-a-service (MaaS) infostealer, providing attackers with dashboards to view stolen credentials and system information. The campaign averaged between 2,000 and 3,000 new infections daily, with most victims located in the United States, Germany, India, and the UK. ([mcafee.com](https://www.mcafee.com/blogs/security-news/minecraft-malware-campaign-research-teen-hacker-cyberbullying/?utm_source=openai)) This incident underscores the evolving threat landscape where cybercriminals exploit popular gaming platforms to distribute malware. The accessibility of WeedHack's MaaS model, with free and low-cost premium tiers, has lowered the barrier for entry, enabling even inexperienced individuals to launch attacks. The campaign's success highlights the need for heightened vigilance and robust security measures within the gaming community. ([mcafee.com](https://www.mcafee.com/blogs/other-blogs/mcafee-labs/weedhack-minecraft-malware-as-a-service-campaign-research/?utm_source=openai))
1 month ago
Kill Chain
Microsoft's Legal Threats Over Zero-Day Disclosures Spark Backlash
In early April 2026, a security researcher known as 'Nightmare-Eclipse' publicly disclosed multiple zero-day vulnerabilities affecting Microsoft products, including 'BlueHammer' (CVE-2026-33825), 'RedSun,' and 'Undefend.' These disclosures were made without prior coordination with Microsoft, leading to active exploitation by threat actors. Microsoft responded by condemning the uncoordinated disclosures and indicated potential legal action against the researcher, citing risks to customer security. This incident underscores the ongoing tension between security researchers and software vendors regarding vulnerability disclosure practices. The situation highlights the critical need for clear and cooperative communication channels to balance the prompt identification of security flaws with the protection of users from potential exploits.
1 month ago
Kill Chain
Anthropic's Mythos AI: A New Era in EU Cybersecurity
In June 2026, Anthropic agreed to grant the European Union's cybersecurity agency, ENISA, access to its advanced AI model, Mythos, under Project Glasswing. This collaboration aims to enhance the EU's capability in identifying and mitigating software vulnerabilities. Mythos has demonstrated the ability to autonomously detect and exploit thousands of zero-day vulnerabilities across major operating systems and web browsers, raising both opportunities and concerns regarding AI's role in cybersecurity. The inclusion of ENISA in Project Glasswing underscores the EU's commitment to leveraging cutting-edge technology to bolster its cyber defenses. This development highlights the growing importance of international cooperation in addressing the dual-use nature of advanced AI tools in cybersecurity. As AI models like Mythos become more prevalent, organizations must stay vigilant and adapt their security strategies to mitigate potential risks associated with AI-assisted vulnerability discovery and exploitation.
1 month ago
Kill Chain
Dashlane Brute-Force Attack Highlights Need for Enhanced 2FA Security
In late May 2026, Dashlane, a prominent password management service, experienced a brute-force attack targeting its two-factor authentication (2FA) system. Attackers attempted to register new devices on user accounts by rapidly submitting numerous numeric combinations to bypass 2FA protections. This led to the temporary suspension of several user accounts as a security measure. While Dashlane's internal systems remained uncompromised, the attackers managed to download encrypted vaults from fewer than 20 personal plan users. These vaults, however, remain secure unless the attackers can decipher the users' master passwords. ([thehackernews.com](https://thehackernews.com/2026/06/dashlane-discloses-brute-force-attack.html?utm_source=openai)) This incident underscores the evolving sophistication of cyber threats, particularly against authentication mechanisms. Organizations must continually assess and fortify their security protocols to mitigate such risks. The event also highlights the importance of user education on creating strong, unique master passwords to enhance the security of encrypted data.
1 month ago
Kill Chain
Microsoft's Legal Threats Against 'Nightmare Eclipse' Stir Controversy in Cybersecurity Community
In May 2026, a security researcher known as 'Nightmare Eclipse' publicly disclosed multiple zero-day vulnerabilities affecting Microsoft Windows systems, including a critical flaw named 'YellowKey' that bypassed BitLocker encryption on Windows 11. These disclosures were made without prior coordination with Microsoft, leading to immediate public exposure of the vulnerabilities. Microsoft responded by threatening legal action against the researcher, citing potential risks to customer security due to the uncoordinated release of exploit code. This incident has ignited a broader debate within the cybersecurity community regarding the ethics and responsibilities associated with vulnerability disclosure practices. The situation underscores the delicate balance between the need for transparency in security research and the potential risks posed by the immediate public release of unpatched vulnerabilities. It also highlights the importance of effective communication and collaboration between security researchers and software vendors to ensure the timely mitigation of security flaws.
1 month ago
Kill Chain
AI-Driven Vulnerability Discovery: A New Era in Cybersecurity
In May 2026, leading technology firms such as Cisco, Microsoft, and Palo Alto Networks reported a significant surge in the discovery of software vulnerabilities, attributed to the deployment of advanced AI models like Mythos Preview and GPT-5.5-Cyber. These AI systems autonomously identified thousands of critical security flaws across various platforms, including Windows and OpenBSD, at an unprecedented speed and scale. This rapid identification has overwhelmed traditional patch management processes, leaving many vulnerabilities unaddressed and increasing the risk of exploitation by malicious actors. The current landscape underscores the urgent need for a paradigm shift in vulnerability disclosure and remediation strategies. Organizations must adopt proactive system hardening measures, implement automated patch management solutions, and foster coordinated efforts among governments, software vendors, and infrastructure operators to enhance cybersecurity resilience in the face of AI-driven vulnerability discovery.
1 month ago
Kill Chain
Anthropic's Project Glasswing Expands to Strengthen Global Cybersecurity
In April 2026, Anthropic launched Project Glasswing, granting approximately 50 organizations access to its advanced AI model, Claude Mythos Preview, to identify software vulnerabilities. By June 2026, the initiative expanded to include around 150 additional organizations across 15 countries, focusing on critical infrastructure sectors such as power, water, healthcare, communications, and hardware. The model has uncovered over 10,000 high- or critical-severity vulnerabilities, with partners like Cloudflare and Mozilla reporting significant increases in bug discovery rates. The rapid identification of vulnerabilities has shifted the cybersecurity landscape, highlighting challenges in verifying, disclosing, and patching flaws before exploitation. A joint report from the Cloud Security Alliance, the SANS Institute, and OWASP warns that organizations may be overwhelmed by threat actors using AI to exploit vulnerabilities faster than defenders can address them.
1 month ago
Kill Chain
WordPress Malware Campaign Exploits Steam Profiles - 2026
In July 2025, a sophisticated malware campaign was discovered targeting nearly 2,000 WordPress websites. Attackers exploited vulnerabilities to inject malicious code that fetched encoded payloads from comments on Steam Community profiles. These payloads, concealed using invisible Unicode characters, directed the compromised sites to load external JavaScript from malicious domains, ultimately installing backdoors for remote code execution. The campaign's reliance on Steam's platform allowed it to evade traditional detection methods by blending malicious traffic with legitimate communications. This incident underscores the evolving tactics of cybercriminals who leverage trusted platforms to obfuscate their command-and-control infrastructure. The use of invisible Unicode characters for payload encoding highlights the need for advanced detection mechanisms capable of identifying such covert techniques. Organizations must remain vigilant and implement robust security measures to protect against these sophisticated threats.
1 month ago
Kill Chain
Dashlane Users Experience Account Suspensions Amid Brute-Force Attack Attempts
In late May 2026, Dashlane, a prominent password management service, detected a series of brute-force attacks targeting user accounts. These attacks involved repeated login attempts from unfamiliar locations and devices, prompting Dashlane's automated security protocols to temporarily suspend the affected accounts to prevent unauthorized access. The company confirmed that its internal systems remained uncompromised and that the suspensions were precautionary measures to safeguard user data. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/dashlane-password-manager-users-locked-out-by-brute-force-attacks/?utm_source=openai)) This incident underscores the persistent threat of brute-force attacks in the cybersecurity landscape. It highlights the importance of robust security measures, such as multi-factor authentication and vigilant monitoring, to protect user accounts from unauthorized access attempts.
1 month ago
Kill Chain
Red Hat npm Packages Compromised in 2026 Supply Chain Attack
In June 2026, Red Hat's '@redhat-cloud-services' npm namespace was compromised, leading to the distribution of over 30 backdoored packages containing the 'Miasma' malware. This supply chain attack targeted developer credentials, cloud secrets, SSH keys, and CI/CD tokens. The attackers allegedly gained access through a compromised Red Hat employee's GitHub account, injecting malicious code into multiple repositories. Red Hat promptly removed the affected packages and reported no impact on customer or partner environments. This incident underscores the escalating threat of supply chain attacks in the software development ecosystem. The use of sophisticated malware like 'Miasma' highlights the need for enhanced security measures in CI/CD pipelines and vigilant monitoring of open-source dependencies to prevent unauthorized access and data breaches.
1 month ago
Kill Chain
DriveSurge's Massive Exploitation of Websites via ClickFix and FakeUpdates
In June 2026, the threat actor known as DriveSurge orchestrated large-scale malware distribution campaigns by compromising thousands of legitimate websites. Utilizing techniques such as ClickFix and FakeUpdates, DriveSurge redirected unsuspecting visitors to malicious infrastructure. ClickFix deceives users into executing harmful commands under the guise of resolving technical issues, while FakeUpdates presents fraudulent software update prompts to deliver malware payloads. These attacks were facilitated through the use of zTDS, an open-source Traffic Distribution System, enabling DriveSurge to profile victims and select the most effective lure. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/hackers-hijack-thousands-of-sites-for-clickfix-and-fakeupdate-attacks/?utm_source=openai)) This incident underscores the evolving sophistication of social engineering tactics employed by cybercriminals. The widespread nature of the campaign highlights the critical need for organizations to implement robust security measures, including regular website audits and user education, to mitigate the risks associated with such deceptive attacks.
1 month ago
Kill Chain
Miasma Attack: Red Hat npm Packages Compromised in June 2026
In June 2026, a sophisticated supply chain attack, dubbed 'Miasma,' compromised over 30 npm packages under the @redhat-cloud-services scope. The attackers infiltrated Red Hat's GitHub Actions OIDC pipeline, injecting a credential-stealing worm into these packages. Upon installation, the malware executed a preinstall script that harvested sensitive information, including GitHub Actions secrets, npm tokens, cloud credentials, Kubernetes tokens, SSH keys, and Git credentials. The stolen data was exfiltrated to attacker-controlled servers, facilitating further propagation of the malware. This incident underscores the escalating threat of supply chain attacks targeting trusted software repositories. The open-sourcing of the Mini Shai-Hulud malware by the cybercriminal group TeamPCP has lowered the barrier for such attacks, enabling a broader range of threat actors to execute similar campaigns. Organizations must enhance their security measures to protect against these evolving threats.
1 month ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports