✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Computer Software/Engineering
Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.
Explore Other Sectors
Computer Software/Engineering Threat Reports
GlassWorm v2 Malware Targets VS Code Extensions in Supply Chain Attack
In April 2026, cybersecurity researchers identified 73 malicious Visual Studio Code (VS Code) extensions on the Open VSX repository, linked to the GlassWorm v2 malware campaign. These extensions, cloned from legitimate ones, initially appeared benign but later delivered malware through updates. Six extensions were confirmed malicious, while others acted as sleeper agents to build trust before deploying harmful payloads. The attackers employed social engineering tactics, such as typosquatting and mimicking legitimate extension icons and descriptions, to deceive developers into installing these compromised extensions. The malware aimed to steal sensitive data, install remote access trojans, and deploy rogue browser extensions to siphon credentials and other information. This incident underscores the evolving nature of supply chain attacks targeting developer environments and the importance of vigilance when installing third-party extensions. The use of sleeper packages and transitive dependencies highlights the need for robust security measures and thorough vetting processes to prevent such infiltrations.
3 months ago
Kill Chain
Robinhood Account Creation Flaw Exploited for Phishing Attacks
In April 2026, threat actors exploited a flaw in Robinhood's account creation process to send phishing emails from the legitimate noreply@robinhood.com address. By embedding malicious HTML into device metadata fields during account registration, attackers generated emails alerting users to 'unrecognized device' logins, prompting them to click on links leading to credential-stealing phishing sites. This method bypassed standard email security checks, making the phishing attempts highly convincing. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/robinhood-account-creation-flaw-abused-to-send-phishing-emails/?utm_source=openai)) This incident underscores the evolving sophistication of phishing tactics, particularly those leveraging legitimate communication channels to deceive users. Organizations must continuously assess and fortify their email security protocols to prevent similar exploits.
3 months ago
Kill Chain
GlassWorm Malware Resurfaces: 73 OpenVSX Sleeper Extensions Compromise Developer Security
In April 2026, the GlassWorm malware campaign resurfaced, targeting the OpenVSX ecosystem with 73 'sleeper' extensions. Initially benign, these extensions were later updated to deliver malicious payloads, compromising developer environments. Six of these extensions have been activated, while the remaining are considered suspicious. This tactic involves cloning legitimate extensions to deceive developers, leading to the theft of sensitive data such as cryptocurrency wallets and credentials. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/glassworm-malware-attacks-return-via-73-openvsx-sleeper-extensions/?utm_source=openai)) This incident underscores the evolving nature of supply chain attacks, highlighting the need for vigilant monitoring of software dependencies. The use of 'sleeper' extensions that activate malicious behavior post-installation represents a sophisticated method to evade initial detection, posing significant risks to software development environments.
3 months ago
Kill Chain
Silk Typhoon Hacker Extradited to US for Cyberespionage
In April 2026, Chinese national Xu Zewei was extradited from Italy to the United States to face charges of cyberespionage. Allegedly operating under the direction of China's Ministry of State Security (MSS) and affiliated with the Silk Typhoon hacking group, Xu is accused of conducting cyber intrusions between February 2020 and June 2021. These operations targeted COVID-19 research organizations and exploited vulnerabilities in Microsoft Exchange Server to gain unauthorized access, deploy malware, and exfiltrate sensitive data. The widespread exploitation impacted thousands of organizations globally before patches were available. This incident underscores the persistent threat posed by state-sponsored cyber actors targeting critical infrastructure and sensitive information. The extradition of Xu Zewei highlights the international cooperation in addressing cyber threats and the ongoing need for robust cybersecurity measures to protect against sophisticated espionage campaigns.
3 months ago
Kill Chain
Supply Chain Attack: 'elementary-data' Package Compromised to Deliver Infostealer
In April 2026, the popular Python package 'elementary-data' (version 0.23.3) was compromised through a GitHub Actions script injection vulnerability. Attackers exploited this flaw to execute malicious code, leading to the unauthorized publication of a backdoored package on PyPI and a malicious Docker image. The compromised package, downloaded over 1.1 million times monthly, contained a secrets stealer targeting SSH keys, cloud credentials, and cryptocurrency wallets. Users who installed this version were advised to rotate all exposed credentials and restore their environments from a known safe point. This incident underscores the critical need for secure CI/CD pipelines and vigilant monitoring of open-source dependencies to prevent supply chain attacks.
3 months ago
Kill Chain
Anthropic's Claude Mythos AI Model Unveils Thousands of Zero-Day Vulnerabilities
In April 2026, Anthropic unveiled Claude Mythos Preview, an advanced AI model capable of autonomously identifying and exploiting zero-day vulnerabilities across major operating systems and web browsers. This model discovered thousands of high-severity vulnerabilities, including a 27-year-old bug in OpenBSD, and demonstrated the ability to chain multiple flaws to bypass security mechanisms. Due to the potential risks associated with its capabilities, Anthropic restricted access to Mythos, providing it only to select industry partners under Project Glasswing to allow for remediation before broader release. The emergence of AI models like Claude Mythos signifies a paradigm shift in cybersecurity, where the speed and scale of vulnerability discovery and exploitation are dramatically increased. This development underscores the urgent need for organizations to enhance their defensive strategies, prioritize rapid patch management, and adopt AI-driven security solutions to keep pace with evolving threats.
3 months ago
Kill Chain
Analyzing GitHub's March 2026 RCE Vulnerability (CVE-2026-3854)
In March 2026, GitHub identified a critical remote code execution (RCE) vulnerability (CVE-2026-3854) affecting its platforms, including GitHub.com and GitHub Enterprise Server. The flaw allowed users with push access to execute arbitrary commands on the server during a git push operation by exploiting unsanitized push options. GitHub promptly validated the issue, deployed a fix within two hours, and confirmed no evidence of exploitation. This incident underscores the importance of rigorous input sanitization and rapid response mechanisms in mitigating supply chain vulnerabilities. As software supply chains grow increasingly complex, organizations must prioritize proactive security measures to prevent similar threats.
3 months ago
Kill Chain
Critical Vulnerability in Hugging Face's LeRobot Exposes Systems to Remote Code Execution
In April 2026, a critical vulnerability (CVE-2026-25874) was identified in Hugging Face's open-source robotics platform, LeRobot. This flaw, stemming from unsafe deserialization practices using Python's pickle module over unauthenticated gRPC channels, allows unauthenticated attackers to execute arbitrary code on both policy servers and robot clients. Exploitation can lead to full system compromise, data theft, and potential physical safety risks due to the nature of robotic operations. This incident underscores the persistent risks associated with deserializing untrusted data, especially in AI and robotics platforms. It highlights the necessity for secure coding practices, robust authentication mechanisms, and the importance of timely patching to mitigate such vulnerabilities.
3 months ago
Kill Chain
After Mythos: New Playbooks For a Zero-Window Era
In April 2026, Anthropic's AI model, Claude Mythos, autonomously identified thousands of zero-day vulnerabilities across major operating systems and web browsers. This unprecedented capability led to the formation of Project Glasswing, a collaborative initiative involving tech giants like Apple, Google, and JPMorgan Chase, aiming to patch vulnerabilities faster than AI can discover them. However, unauthorized access to Mythos raised significant security concerns, highlighting the potential risks of such powerful AI tools. ([anthropic.com](https://www.anthropic.com/glasswing?utm_source=openai)) The incident underscores the urgent need for robust security protocols in AI development and deployment. As AI models become more sophisticated, ensuring their secure use is paramount to prevent potential misuse and safeguard critical infrastructure.
3 months ago
Kill Chain
Microsoft Entra ID Agent ID Administrator Role Privilege Escalation Vulnerability
In March 2026, a critical vulnerability was identified in Microsoft Entra ID's Agent ID Administrator role, designed to manage AI agent identities. This flaw allowed users with this role to take over arbitrary service principals by assigning themselves as owners and adding new credentials, potentially escalating privileges to the Global Administrator level. Microsoft addressed the issue by April 9, 2026, restricting the role's permissions to prevent such unauthorized access. This incident underscores the importance of stringent role scoping and continuous monitoring of privileged accounts to prevent similar security breaches in the future.
3 months ago
Kill Chain
UNC6692's 'Snow' Malware: A New Era of Social Engineering Attacks
In December 2025, the threat actor UNC6692 initiated a sophisticated attack combining social engineering, cloud service exploitation, and custom malware. The campaign began with a flood of spam emails to targets, followed by impersonation of IT helpdesk staff via Microsoft Teams. Victims were deceived into downloading a fake 'Mailbox Repair Utility,' which installed the 'Snow' malware suite, including Snowbelt, Snowglaze, and Snowbasin. This malware facilitated unauthorized access, credential theft, and lateral movement within enterprise networks. The attackers leveraged AWS S3 buckets for payload delivery and command-and-control infrastructure, effectively bypassing traditional security measures. ([darkreading.com](https://www.darkreading.com/cloud-security/unc6692-social-engineering-malware-cloud-abuse/?utm_source=openai)) This incident underscores the evolving tactics of cyber adversaries who exploit trusted cloud services and communication platforms to infiltrate organizations. The use of legitimate cloud infrastructure for malicious purposes highlights the need for enhanced monitoring of cloud-based activities and user education to recognize sophisticated social engineering attempts.
3 months ago
Kill Chain
GlassWorm Campaign Escalates with Malicious VS Code Extensions
In April 2026, the GlassWorm campaign escalated by deploying 73 malicious Visual Studio (VS) Code extensions on the Open VSX marketplace. These extensions, initially appearing benign, were later updated to deliver self-replicating malware, compromising developer environments and potentially poisoning the software supply chain. The malware utilized techniques such as external payload retrieval and bundled native binaries, acting as thin loaders to evade detection. This approach allowed attackers to access sensitive information, including source code, credentials, and internal systems, posing significant risks to organizations relying on these tools. The resurgence of GlassWorm highlights the evolving nature of supply chain attacks, emphasizing the need for continuous monitoring of software dependencies. Organizations must implement stringent security measures, such as verifying the authenticity of extensions, auditing installed tools for recent updates, and educating developers on the risks associated with third-party software. This incident underscores the critical importance of securing the software development lifecycle to prevent widespread compromise.
3 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports