✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Computer Software/Engineering
Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.
Explore Other Sectors
Computer Software/Engineering Threat Reports
Axios npm Package Compromise: A 2026 Supply Chain Attack
In late March 2026, attackers compromised the npm account of a lead maintainer of Axios, a widely-used JavaScript HTTP client library. They published two malicious versions, `axios@1.14.1` and `axios@0.30.4`, which included a trojanized dependency named `plain-crypto-js`. This dependency executed a `postinstall` script that downloaded and installed a cross-platform Remote Access Trojan (RAT) targeting macOS, Windows, and Linux systems. The malicious packages were available for approximately three hours before being removed by npm. ([tomshardware.com](https://www.tomshardware.com/tech-industry/cyber-security/axios-npm-package-compromised-in-supply-chain-attack-that-deployed-a-cross-platform-rat?utm_source=openai)) This incident underscores the growing threat of supply chain attacks targeting open-source software repositories. The rapid deployment and removal of the malicious packages highlight the need for vigilant monitoring and swift response mechanisms within the software development community.
2 months ago
Kill Chain
Typosquatting Supply Chain Attack 2026: A New Era of Cyber Threats
In December 2025, attackers exploited typosquatting techniques to embed AI-generated lookalike domains within legitimate third-party scripts running on web properties. This method allowed malicious code to execute in users' browsers without requiring mistyped URLs or server breaches, leading to significant data exfiltration and financial losses. The Trust Wallet incident exemplifies this trend, where a trojanized Chrome extension resulted in the theft of $8.5 million from 2,500 wallets within 48 hours. This incident underscores a critical shift in cyber threats, highlighting the vulnerability of supply chains to typosquatting attacks. The rapid generation of convincing domain variants by AI tools has outpaced traditional security measures, necessitating enhanced detection capabilities and vigilance in monitoring third-party scripts.
2 months ago
Kill Chain
GitHub Breach 2026: Understanding TeamPCP's Supply Chain Attack
In May 2026, GitHub experienced a significant security breach when an employee's device was compromised through a malicious Visual Studio Code extension. This intrusion allowed the threat actor known as TeamPCP to exfiltrate approximately 3,800 internal repositories containing proprietary source code and internal organizational data. TeamPCP subsequently listed this data for sale on a cybercrime forum, demanding a minimum of $50,000, with threats to release the information publicly if no buyer emerged. GitHub has stated that, as of now, there is no evidence indicating that customer data or external repositories were affected. This incident underscores the escalating threat posed by supply chain attacks targeting development environments. The use of compromised development tools to infiltrate organizations highlights the need for heightened vigilance and robust security measures within software development processes. Organizations must reassess their security protocols to mitigate the risks associated with such sophisticated attack vectors.
2 months ago
Kill Chain
Microsoft Disrupts Fox Tempest's Malware-Signing Service
In May 2026, Microsoft disrupted a malware-signing-as-a-service (MSaaS) operation run by the threat actor Fox Tempest. This operation exploited Microsoft's Artifact Signing system to generate fraudulent code-signing certificates, enabling cybercriminals to distribute malware that appeared legitimate. Fox Tempest's service was linked to various ransomware groups, including Vanilla Tempest, Storm-0501, Storm-2561, and Storm-0249, facilitating attacks that compromised thousands of machines and networks worldwide. The disruption involved seizing domain names, websites, and Azure resources associated with Fox Tempest, effectively dismantling their infrastructure. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/05/19/exposing-fox-tempest-a-malware-signing-service-operation/?utm_source=openai)) This incident underscores the evolving tactics of cybercriminals who increasingly abuse legitimate services to enhance the effectiveness of their attacks. The takedown of Fox Tempest highlights the critical need for continuous monitoring and rapid response to such threats, as well as the importance of strengthening verification processes to prevent the misuse of code-signing tools. ([blogs.microsoft.com](https://blogs.microsoft.com/on-the-issues/2026/05/19/disrupting-fox-tempest-a-cybercrime-service/?utm_source=openai))
2 months ago
Kill Chain
Mini Shai-Hulud 2026: Unveiling TeamPCP's npm Supply Chain Attack
In May 2026, the self-replicating malware campaign known as Mini Shai-Hulud resurfaced, compromising hundreds of npm packages. The threat actor, TeamPCP, utilized this campaign to autonomously spread malware, install persistent OS-level backdoors, and harvest sensitive credentials such as GitHub tokens, npm tokens, SSH keys, and cloud provider credentials. The malware executed upon package installation, affecting both local development environments and CI/CD pipelines, and propagated by republishing infected packages under legitimate maintainers' names. ([cyberscoop.com](https://cyberscoop.com/mini-shai-hulud-malware-npm-packages-compromised-again/?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting open-source ecosystems. The ability of such malware to persist beyond standard remediation efforts, like package removal, highlights the need for comprehensive security measures, including thorough auditing of developer tools and CI/CD environments, to prevent unauthorized access and data exfiltration.
2 months ago
Kill Chain
GitHub Breach: 3,800 Internal Repositories Exfiltrated via Malicious VS Code Extension
In May 2026, GitHub experienced a security breach where approximately 3,800 internal repositories were exfiltrated. The breach occurred after an employee's device was compromised through a malicious Visual Studio Code (VS Code) extension. The attackers, identified as TeamPCP, gained access to GitHub's internal systems via this poisoned extension. GitHub has stated that there is no evidence of customer data being affected and has initiated incident response measures, including rotating critical secrets and monitoring for further activity. This incident highlights the increasing threat posed by supply chain attacks targeting developer tools and environments. Malicious extensions in widely used platforms like VS Code can serve as entry points for attackers, emphasizing the need for enhanced security measures and vigilance in software development practices.
2 months ago
Kill Chain
7-Eleven Data Breach 2026: ShinyHunters Expose 600,000 Records
In April 2026, 7-Eleven experienced a significant data breach orchestrated by the cybercriminal group ShinyHunters. The attackers infiltrated 7-Eleven's systems, specifically targeting the company's Salesforce environment, and exfiltrated over 600,000 records containing personally identifiable information (PII) and internal corporate data. Following the breach, ShinyHunters issued a ransom demand, threatening to publicly release the stolen data if their demands were not met. When 7-Eleven declined to comply, the group proceeded to leak the data online, exposing sensitive information of numerous individuals and potentially compromising the company's operations and reputation. ([neuracybintel.com](https://www.neuracybintel.com/articles/shinyhunters-claims-7-eleven-breach-threatens-to-leak-600000-salesforce-records?utm_source=openai)) This incident underscores a growing trend among cybercriminals to exploit vulnerabilities in third-party platforms and cloud services, such as Salesforce, to gain unauthorized access to sensitive data. Organizations are increasingly being targeted through their supply chains and integrated services, highlighting the need for robust security measures and vigilant monitoring of all connected systems to prevent similar breaches.
2 months ago
Kill Chain
Shai-Hulud Malware Compromises 600+ npm Packages in May 2026
In May 2026, a significant supply chain attack known as the Shai-Hulud campaign compromised over 600 npm packages, primarily targeting the @antv ecosystem. Threat actors infiltrated developer accounts to publish malicious versions of popular JavaScript libraries, including echarts-for-react, @antv/g2, and timeago.js. The malware harvested sensitive information from developer environments and CI/CD pipelines, exfiltrating data via encrypted channels to evade detection. This incident underscores the escalating threat of supply chain attacks within open-source ecosystems, highlighting the need for enhanced security measures in software development pipelines. The attackers' use of valid Sigstore provenance attestations to lend credibility to malicious packages represents a concerning evolution in attack methodologies, emphasizing the urgency for developers and organizations to implement robust verification processes and maintain vigilance against such sophisticated threats.
2 months ago
Kill Chain
Microsoft Disrupts Fox Tempest: A Cybercrime Service Exploiting Trusted Platforms
In May 2026, Microsoft disrupted a cybercrime operation known as Fox Tempest, which had been abusing Microsoft's Artifact Signing service to generate fraudulent code-signing certificates. These certificates allowed malware to be digitally signed, making it appear as legitimate software to users and operating systems. Fox Tempest created over a thousand certificates and established hundreds of Azure tenants and subscriptions to support its operations. The service was linked to various malware and ransomware campaigns, including those involving Oyster, Lumma Stealer, Vidar, and ransomware families such as Rhysida, Akira, INC, Qilin, and BlackByte. Microsoft seized the domain signspace[.]cloud, took hundreds of virtual machines offline, and blocked access to the infrastructure hosting the cybercrime platform. This action underscores the evolving tactics of cybercriminals who exploit trusted platforms to distribute malware, highlighting the need for continuous vigilance and adaptive security measures.
2 months ago
Kill Chain
Critical ChromaDB Vulnerability (CVE-2026-45829) Exposes AI Servers to Remote Code Execution
In May 2026, a critical vulnerability identified as CVE-2026-45829 was discovered in ChromaDB's Python FastAPI server, affecting versions 1.0.0 and later. This flaw allows unauthenticated attackers to execute arbitrary code on exposed servers by sending crafted requests that exploit the server's handling of model repositories. The vulnerability arises from improper authentication checks, enabling attackers to load and execute malicious models from external sources like Hugging Face before any authentication is performed. This can lead to full server compromise, data exfiltration, and disruption of AI/ML workflows. The incident underscores the growing risks associated with AI infrastructure vulnerabilities, especially as AI applications become more integrated into critical business operations. Organizations must prioritize securing their AI systems by implementing robust authentication mechanisms, conducting regular security audits, and staying vigilant against emerging threats targeting AI platforms.
2 months ago
Kill Chain
Unveiling Trapdoor: The 2026 Android Ad Fraud Scheme
In May 2026, cybersecurity researchers uncovered 'Trapdoor,' a sophisticated ad fraud and malvertising operation targeting Android users. The scheme involved 455 malicious apps and 183 command-and-control domains, creating a self-sustaining cycle of fraud. Users unknowingly downloaded utility-style apps, which then initiated malvertising campaigns, coercing them into installing additional malicious apps. These secondary apps launched hidden WebViews, loaded threat actor-controlled HTML5 domains, and requested ads, leading to 659 million daily bid requests and over 24 million app downloads, primarily affecting users in the U.S. ([thehackernews.com](https://thehackernews.com/2026/05/trapdoor-android-ad-fraud-scheme-hit.html?utm_source=openai)) This incident highlights the evolving tactics of cybercriminals who blend legitimate tools with malicious intent, emphasizing the need for continuous vigilance and advanced detection mechanisms to protect users from such deceptive schemes.
2 months ago
Kill Chain
AI-Driven Vulnerability Discovery: Transforming Cybersecurity in 2026
In April 2026, Anthropic's AI model, Mythos, identified thousands of previously unknown vulnerabilities across major operating systems and web browsers, including a 27-year-old flaw in OpenBSD. This unprecedented discovery underscores the transformative impact of AI in cybersecurity, enabling rapid identification of critical vulnerabilities that had remained undetected for decades. ([ibm.com](https://www.ibm.com/think/insights/the-mythos-moment-when-discovery-outpaces-defense?utm_source=openai)) The rapid pace of AI-driven vulnerability discovery has compressed the timeline between identification and potential exploitation, necessitating immediate and robust defensive measures. Organizations must adapt to this accelerated threat landscape by integrating AI-powered tools into their security protocols to effectively manage and mitigate emerging risks. ([sans.org](https://www.sans.org/press/announcements/emergency-strategy-briefing-ai-driven-vulnerability-discovery-compresses-exploit-timelines?utm_source=openai))
2 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports