✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Computer Software/Engineering
Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.
Explore Other Sectors
Computer Software/Engineering Threat Reports
Analyzing the UNC6040 Breach of Google's Salesforce Instance
In June 2025, Google's internal Salesforce instance was compromised by the cybercriminal group UNC6040, also known as ShinyHunters. The attackers employed a sophisticated voice phishing (vishing) campaign, impersonating IT support to deceive employees into installing a malicious version of Salesforce's Data Loader application. This granted unauthorized access to sensitive business customer data, including names and contact details. The breach was swiftly identified and contained by Google, minimizing the exposure of sensitive information. ([avertium.com](https://www.avertium.com/flash-notices/flash-notice-google-salesforce-breach-an-in-depth-analysis-of-unc6040?utm_source=openai)) This incident underscores the escalating threat posed by social engineering attacks targeting cloud-based platforms. Organizations are urged to enhance their security measures, particularly in training employees to recognize and resist such deceptive tactics, to prevent similar breaches in the future.
3 months ago
Kill Chain
DraftKings Credential-Stuffing Attack Results in 30-Month Prison Sentence
In November 2022, DraftKings, a prominent sports betting platform, experienced a credential-stuffing attack that compromised nearly 68,000 user accounts. Attackers utilized previously stolen credentials to gain unauthorized access, leading to the theft of approximately $635,000 from around 1,600 accounts. The perpetrators, including Nathan Austad and Joseph Garrison, sold access to these accounts, with accomplice Kamerin Stokes reselling them through his own platform. Stokes, known online as 'TheMFNPlug,' continued his illicit activities even after initial legal actions, reopening his shop with the tagline 'fraud is fun.' This incident underscores the persistent threat of credential-stuffing attacks, especially in industries handling sensitive financial information. The case highlights the importance of robust cybersecurity measures and the need for users to employ unique, strong passwords across different platforms to mitigate such risks.
3 months ago
Kill Chain
Operation PowerOFF Dismantles 53 DDoS-for-Hire Domains, Exposes 3 Million Criminal Accounts
In April 2026, an international law enforcement operation known as Operation PowerOFF targeted the DDoS-for-hire ecosystem across 21 countries. Authorities seized 53 domains, arrested four individuals, and identified over 75,000 users involved in launching DDoS attacks. The operation disrupted booter services and dismantled infrastructure, including servers and databases, that supported these illicit activities. ([cyberscoop.com](https://cyberscoop.com/ddos-for-hire-takedowns-operation-poweroff/?utm_source=openai)) This crackdown underscores the persistent threat posed by DDoS-for-hire services, which enable individuals with minimal technical expertise to launch significant cyberattacks. The operation highlights the necessity for continuous vigilance and international cooperation to combat evolving cyber threats. ([cyberscoop.com](https://cyberscoop.com/ddos-for-hire-takedowns-operation-poweroff/?utm_source=openai))
3 months ago
Kill Chain
North Korea's Sapphire Sleet Exploits ClickFix to Target macOS Users
In April 2026, the North Korean state-sponsored group Sapphire Sleet launched a sophisticated cyber campaign targeting macOS users. Utilizing the 'ClickFix' social engineering technique, attackers posed as recruiters on professional networking platforms, engaging victims with fake job offers. They directed targets to install a malicious 'Zoom SDK Update.scpt' file, which, when executed, initiated a multi-stage payload chain. This chain included credential harvesters, data stealers targeting wallets and keychains, and backdoors for persistence. Notably, the malware bypassed Apple's Transparency, Consent, and Control (TCC) security framework, allowing unauthorized actions without user prompts. The campaign resulted in significant data exfiltration and potential financial losses for affected individuals and organizations. ([darkreading.com](https://www.darkreading.com/application-security/north-korea-clickfix-target-macos-users-data/?utm_source=openai)) This incident underscores the evolving tactics of nation-state actors in targeting macOS platforms, highlighting the need for heightened vigilance against social engineering attacks and the importance of robust endpoint security measures.
3 months ago
Kill Chain
Understanding CVE-2026-26144: The Zero-Click XSS Vulnerability in Microsoft Excel
In March 2026, Microsoft disclosed CVE-2026-26144, a critical cross-site scripting (XSS) vulnerability in Excel. This flaw allows attackers to embed malicious scripts within Excel files, which, when processed by the Copilot Agent, can autonomously exfiltrate data to external servers without user interaction. The vulnerability affects Microsoft 365 Apps for Enterprise versions 16.0.1 and below, posing significant risks to organizations relying on Excel for sensitive data management. ([system.plus](https://system.plus/2026/03/12/zero-click-microsoft-copilot-bug-cve-2026-26144/?utm_source=openai)) The incident underscores the evolving threat landscape where AI integrations can amplify traditional vulnerabilities, leading to zero-click exploits. Organizations must reassess their security postures, especially concerning AI-enabled applications, to mitigate such risks effectively.
3 months ago
Kill Chain
Lumma Stealer and Sectop RAT: A 2026 Cybersecurity Threat Analysis
In April 2026, a sophisticated malware campaign was identified, involving the Lumma Stealer and Sectop RAT (ArechClient2). The attack began with users downloading a password-protected 7-zip archive, disguised as cracked software, which contained an inflated Windows executable designed to evade detection. Upon execution, Lumma Stealer was installed, exfiltrating sensitive data such as credentials and financial information. Subsequently, Sectop RAT was deployed, granting attackers remote control over the infected systems. This multi-stage infection chain highlights the evolving tactics of cybercriminals in leveraging multiple malware strains to maximize impact. The incident underscores the persistent threat posed by malware-as-a-service platforms like Lumma Stealer, which have been active since 2022. Despite previous disruptions to its infrastructure, Lumma Stealer continues to evolve, employing advanced obfuscation techniques and deceptive delivery methods, such as fake CAPTCHA pages, to infiltrate systems. The integration of Sectop RAT further amplifies the risk, enabling attackers to maintain prolonged access and control over compromised devices.
3 months ago
Kill Chain
Critical Authorization Flaw in AVEVA Pipeline Simulation: CVE-2026-5387
In April 2026, a critical vulnerability (CVE-2026-5387) was identified in AVEVA Pipeline Simulation software, affecting versions up to 2025 SP1 build 7.1.9497.6351. This flaw allows unauthenticated attackers to perform operations reserved for high-privilege roles, such as modifying simulation parameters and training records, leading to potential privilege escalation. ([cvefeed.io](https://cvefeed.io/vuln/detail/CVE-2026-5387?utm_source=openai)) The incident underscores the importance of robust authorization mechanisms in industrial control systems. Organizations are urged to upgrade to AVEVA Pipeline Simulation 2025 SP1 P01 (build 7.1.9580.8513) or higher and implement network access restrictions to mitigate this risk. ([aveva.com](https://www.aveva.com/en/support-and-success/cyber-security-updates/?utm_source=openai))
3 months ago
Kill Chain
Anthropic's Claude Mythos AI: A Game-Changer in Cybersecurity
In April 2026, Anthropic unveiled Claude Mythos Preview, an advanced AI model capable of autonomously identifying and exploiting software vulnerabilities across major operating systems and web browsers. The model discovered thousands of zero-day vulnerabilities, including a 27-year-old flaw in OpenBSD and a 16-year-old bug in FFmpeg. Due to its potent capabilities, Anthropic restricted access to select organizations under Project Glasswing to prevent potential misuse. This initiative involves collaboration with major tech companies to responsibly address and patch these vulnerabilities. The emergence of such powerful AI tools underscores the need for enhanced cybersecurity measures and collaborative efforts to safeguard critical infrastructure. The rapid advancement of AI in cybersecurity presents both opportunities and challenges, necessitating a reevaluation of existing security protocols and the development of new strategies to mitigate potential risks.
3 months ago
Kill Chain
US Nationals Sentenced for Facilitating North Korean Tech Worker Scheme
In April 2026, two U.S. nationals, Kejia Wang and Zhenxing Wang, were sentenced to nine years and 92 months in prison, respectively, for facilitating a scheme that enabled North Korean IT workers to pose as American employees. This operation, running from 2021 to 2024, involved the use of stolen identities from over 80 U.S. citizens to secure remote positions at more than 100 U.S. companies, including Fortune 500 firms. The scheme generated over $5 million for the North Korean regime and resulted in U.S. companies incurring damages exceeding $3 million. The perpetrators managed 'laptop farms' within the U.S., allowing North Korean operatives to remotely access company systems, leading to the theft of sensitive data, including export-controlled military technology. This incident underscores the evolving tactics of state-sponsored cyber operations and highlights the critical need for robust identity verification and cybersecurity measures in remote hiring processes. Organizations must remain vigilant against sophisticated insider threats that exploit remote work infrastructures to infiltrate corporate networks and exfiltrate sensitive information.
3 months ago
Kill Chain
U.S. Nationals Sentenced for Facilitating North Korean IT Worker Infiltration
Between 2021 and October 2024, U.S. nationals Kejia Wang and Zhenxing Wang facilitated a scheme enabling North Korean IT workers to secure remote positions at over 100 U.S. companies, including Fortune 500 firms. By creating fake websites, shell companies, and hosting company-issued laptops in U.S. residences, they masked the workers' true identities, generating over $5 million for the North Korean government and causing approximately $3 million in damages to the affected companies. ([nationaltoday.com](https://nationaltoday.com/us/ma/boston/news/2026/04/16/two-americans-sentenced-for-helping-north-korea-obtain-remote-it-jobs/?utm_source=openai)) This incident underscores the evolving tactics of nation-state actors exploiting remote work infrastructures to infiltrate organizations, emphasizing the need for robust identity verification and cybersecurity measures to protect against such sophisticated schemes.
3 months ago
Kill Chain
McGraw Hill's 2026 Data Breach: A Wake-Up Call for Third-Party Security
In April 2026, McGraw Hill, a leading educational publisher, experienced a data breach orchestrated by the cybercriminal group ShinyHunters. The attackers exploited a misconfiguration in McGraw Hill's Salesforce environment, gaining unauthorized access to a webpage hosted on the platform. This breach led to the exfiltration of personally identifiable information (PII) from approximately 13.5 million user accounts, including names, physical addresses, phone numbers, and email addresses. McGraw Hill confirmed the incident, emphasizing that their internal systems, customer databases, and educational platforms remained secure. The company attributed the breach to a broader issue affecting multiple organizations utilizing Salesforce, highlighting the risks associated with third-party service integrations. ([techradar.com](https://www.techradar.com/pro/security/this-activity-appears-to-be-part-of-a-broader-issue-education-company-mcgraw-hill-becomes-latest-to-see-its-salesforce-data-hacked?utm_source=openai)) This incident underscores the escalating threat posed by cybercriminal groups like ShinyHunters, who have shifted focus from traditional ransomware attacks to data extortion schemes. By exploiting vulnerabilities in widely-used platforms such as Salesforce, these actors can access vast amounts of sensitive data, posing significant risks to organizations and their customers. The McGraw Hill breach serves as a critical reminder for companies to rigorously assess and secure their third-party integrations to prevent similar incidents.
3 months ago
Kill Chain
ATHR: AI-Powered Vishing Platform Revolutionizes Automated Attacks
In April 2026, cybersecurity researchers identified 'ATHR,' a sophisticated cybercrime platform that automates voice phishing (vishing) attacks using AI-driven voice agents. The platform orchestrates the entire attack chain: sending deceptive emails that prompt victims to call a provided number, which connects them to AI agents impersonating legitimate support staff. These agents guide victims through a simulated security verification process to extract sensitive information, such as six-digit verification codes, enabling unauthorized access to accounts on services like Google, Microsoft, and Coinbase. The emergence of ATHR underscores a significant evolution in social engineering tactics, leveraging AI to enhance the scale and believability of vishing attacks. This development highlights the urgent need for organizations to bolster their defenses against AI-powered social engineering threats, as traditional detection methods may be insufficient against such advanced techniques.
3 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports