✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Computer Software/Engineering
Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.
Explore Other Sectors
Computer Software/Engineering Threat Reports
Understanding the 2026 Google Workspace OAuth Attack
In March 2026, a sophisticated phishing campaign exploited OAuth redirection mechanisms to compromise Google Workspace accounts. Attackers crafted malicious OAuth applications that, when users attempted to authenticate, redirected them from trusted identity providers to attacker-controlled sites, leading to malware downloads. This method allowed adversaries to bypass traditional phishing defenses by leveraging legitimate authentication flows. The incident underscores the evolving tactics of threat actors who exploit standard protocol behaviors to gain unauthorized access, highlighting the need for organizations to implement stringent OAuth governance and cross-domain detection strategies.
4 months ago
Kill Chain
Perplexity Comet Browser's 'PleaseFix' Vulnerabilities Expose Critical Security Flaws
In March 2026, Zenity Labs disclosed critical vulnerabilities in Perplexity's AI-powered Comet browser, collectively termed 'PleaseFix.' These flaws allowed attackers to exploit indirect prompt injections, enabling unauthorized access to local files and credential theft without user interaction. By embedding malicious prompts in trusted content, such as calendar invites, attackers could manipulate the AI agent to perform unauthorized actions, including exfiltrating sensitive data and compromising password managers like 1Password. Perplexity addressed these vulnerabilities following responsible disclosure, implementing fixes to prevent autonomous access to local file systems and unauthorized credential manipulation. This incident underscores the inherent security challenges in agentic AI systems, highlighting the need for robust safeguards against prompt injection attacks and the importance of continuous monitoring and updating of AI-driven applications to mitigate emerging threats.
4 months ago
Kill Chain
The Rising Threat of Compromised cPanel Credentials in Cybercrime Markets
In March 2025, a cybercriminal known as "miya" advertised for sale compromised SSH, cPanel, Mail, and WebHost Manager (WHM) credentials belonging to a Canadian car dealership on a dark web forum, pricing the access at $400. These credentials provided potential attackers with privileged access to the dealership's critical systems, including remote command-line server control via SSH, administrative capabilities through WHM and cPanel, and access to sensitive communications via the mail server. The breach underscored the escalating cybersecurity risks faced by automotive retailers, who increasingly rely on interconnected digital systems to manage sales, customer data, and backend infrastructure. ([cyberpress.org](https://cyberpress.org/cybercriminal-miya-stolen/?utm_source=openai)) This incident highlights a broader trend of cybercriminals targeting cPanel and other site management credentials to facilitate unauthorized access to web servers and associated services. The sale of such credentials on underground forums has become increasingly common, with prices ranging from $3 to $5, depending on the target and level of access provided. ([documents.trendmicro.com](https://documents.trendmicro.com/assets/wp/wp-north-american-underground.pdf?utm_source=openai))
4 months ago
Kill Chain
Chrome's 2026 Vulnerability: A Wake-Up Call for Browser Security
In January 2026, a high-severity vulnerability (CVE-2026-0628) was identified in Google Chrome's WebView component, allowing attackers to escalate privileges via malicious extensions. This flaw, present in versions prior to 143.0.7499.192, enabled unauthorized script or HTML injection into privileged pages, potentially granting access to sensitive resources. Google promptly addressed the issue by releasing a patch on January 7, 2026. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-0628?utm_source=openai)) The incident underscores the critical importance of timely software updates and vigilant extension management. As browser vulnerabilities continue to be a prime target for cyber threats, organizations must prioritize regular patching and educate users on the risks associated with unverified extensions to mitigate potential security breaches.
4 months ago
Kill Chain
OpenClaw Vulnerability Highlights AI Agent Security Risks
In February 2026, a critical vulnerability (CVE-2026-25253) was discovered in OpenClaw, an open-source AI agent platform, allowing attackers to execute arbitrary code on users' systems via malicious web pages. This flaw exposed over 42,000 instances globally, leading to unauthorized access, data exfiltration, and potential system compromise. The vulnerability was promptly patched in version 2026.1.29, but the incident highlighted significant security concerns inherent in AI agent architectures. ([taoapex.com](https://taoapex.com/en/guides/deploy-personal-ai-assistant-openclaw/?utm_source=openai)) The rapid adoption of AI agents like OpenClaw has outpaced the development of robust security measures, making them attractive targets for cybercriminals. This incident underscores the urgent need for comprehensive security frameworks and best practices to mitigate risks associated with autonomous AI systems.
4 months ago
Kill Chain
Understanding OAuth Redirection Abuse in Phishing Attacks
In March 2026, Microsoft identified a sophisticated phishing campaign exploiting OAuth's redirection mechanisms to deliver malware. Attackers crafted URLs using legitimate identity providers like Microsoft Entra ID and Google Workspace, embedding them in phishing emails with themes such as e-signature requests and financial documents. When recipients clicked these links, they were redirected through trusted domains to attacker-controlled sites, leading to malware downloads. This method effectively bypassed traditional email and browser security defenses, resulting in significant compromises across government and public-sector organizations. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/03/02/oauth-redirection-abuse-enables-phishing-malware-delivery/?utm_source=openai)) This incident underscores a growing trend where threat actors leverage legitimate protocol features to conduct malicious activities. The abuse of OAuth redirection highlights the need for organizations to enhance monitoring of authentication flows and implement stricter controls over third-party application permissions to mitigate such evolving threats.
4 months ago
Kill Chain
IBM Bob's 2026 Prompt Injection Vulnerability Exposes AI Security Risks
In January 2026, security researchers at Prompt Armor identified a critical vulnerability in IBM's generative AI tool, Bob, which was in its beta phase. The flaw allowed for indirect prompt injection attacks, enabling malicious actors to embed hidden commands within emails or calendar entries. When Bob processed these inputs, it could be manipulated to perform unauthorized actions such as data exfiltration, malware execution, or establishing persistent system access. This vulnerability was particularly concerning due to Bob's integration capabilities with other applications, amplifying the potential attack surface. The incident underscores the inherent risks associated with AI systems that process untrusted data sources. As AI tools become more integrated into business workflows, the potential for such vulnerabilities increases, highlighting the need for robust security measures. Organizations must prioritize the development and implementation of safeguards to prevent prompt injection attacks and ensure the secure deployment of AI technologies.
4 months ago
Kill Chain
Alabama Man's Cyber Extortion Scheme Exposes Vulnerabilities in Social Media Security
Between April 2022 and May 2025, Jamarcus Mosley, a 22-year-old from Mobile, Alabama, orchestrated a cyber extortion scheme targeting hundreds of young women, including minors, across the United States. By impersonating friends and acquaintances, Mosley deceived victims into providing account recovery codes, enabling him to hijack their Snapchat and Instagram accounts. He then accessed private, intimate images and videos, threatening to publicly release the content unless victims complied with his demands for additional explicit material or monetary payments. This operation spanned multiple states, with documented cases in Georgia, Florida, and Illinois. ([justice.gov](https://www.justice.gov/usao-ndga/pr/online-predator-pleads-guilty-hacking-social-media-accounts-and-extorting-hundreds?utm_source=openai)) The case underscores the growing threat of social engineering attacks and the exploitation of personal relationships in the digital age. As individuals increasingly share personal content online, the risk of such intimate data being weaponized by malicious actors rises. This incident serves as a stark reminder of the importance of digital literacy, robust security practices, and the need for vigilance in online interactions to prevent similar breaches.
5 months ago
Kill Chain
Phishing Campaign Exploits Fake Google Security Page and PWA to Steal Credentials
In March 2026, a sophisticated phishing campaign emerged, utilizing a counterfeit Google Account security page to deploy a malicious Progressive Web App (PWA). This app deceived users into granting permissions that enabled the theft of one-time passcodes, cryptocurrency wallet addresses, and other sensitive data. Additionally, the malware transformed victims' browsers into proxies for attacker traffic, facilitating further network exploitation. The attackers employed the domain google-prism[.]com to mimic legitimate Google services, leading users through a deceptive setup process that included installing the harmful PWA and, in some cases, a companion Android application. This incident underscores the evolving tactics of cybercriminals who exploit trusted platforms and social engineering to bypass traditional security measures. The use of PWAs in phishing attacks highlights the need for heightened vigilance and the adoption of advanced security protocols to protect against such sophisticated threats.
5 months ago
Kill Chain
North Korean Hackers Exploit npm Packages in 2026 Supply Chain Attack
In March 2026, North Korean state-sponsored hackers launched a sophisticated supply chain attack by publishing 26 malicious npm packages disguised as developer tools. These packages utilized steganography to extract command-and-control (C2) URLs from seemingly benign Pastebin content, ultimately deploying a cross-platform remote access trojan (RAT) targeting developers. The C2 infrastructure was hosted on Vercel across 31 deployments, enabling the attackers to execute commands, exfiltrate sensitive data, and maintain persistent access to compromised systems. This incident underscores the evolving tactics of threat actors in exploiting trusted open-source ecosystems to infiltrate developer environments. The use of steganography and multi-stage payload delivery highlights the increasing complexity of supply chain attacks, emphasizing the need for enhanced vigilance and security measures within the software development community.
5 months ago
Kill Chain
Understanding the Google Gemini 2025 Prompt Injection Vulnerability
In mid-2025, security researchers identified a significant vulnerability in Google's AI assistant, Gemini, integrated into Gmail and other Workspace applications. This flaw, known as 'prompt injection,' allowed attackers to embed hidden instructions within emails using HTML and CSS techniques, such as invisible text. When Gemini processed these emails to generate summaries, it executed the concealed commands, potentially leading to deceptive summaries that could mislead users into divulging sensitive information or performing unintended actions. The exploitation of this vulnerability posed substantial risks, including unauthorized access to user data and increased susceptibility to phishing attacks. ([techradar.com](https://www.techradar.com/pro/security/google-gemini-can-be-hijacked-to-display-fake-email-summaries-in-phishing-scams?utm_source=openai)) The discovery of this vulnerability underscores the evolving nature of cyber threats targeting AI-driven platforms. As AI assistants become more integrated into daily workflows, they present new attack vectors that traditional security measures may not fully address. This incident highlights the critical need for continuous monitoring and updating of AI systems to safeguard against emerging threats and to maintain user trust in these technologies.
5 months ago
Kill Chain
Chrome's 2026 WebView Vulnerability: A Cautionary Tale of Malicious Extensions
In January 2026, a high-severity vulnerability (CVE-2026-0628) was discovered in Google Chrome's WebView component, allowing attackers to exploit insufficient policy enforcement. By convincing users to install malicious extensions, attackers could inject scripts or HTML into privileged pages, potentially leading to unauthorized data access and system compromise. Google promptly addressed this issue by releasing Chrome version 143.0.7499.192, mitigating the risk posed by this flaw. ([thehackerwire.com](https://www.thehackerwire.com/vulnerability/CVE-2026-0628/?utm_source=openai)) This incident underscores the critical importance of vigilant extension management and prompt software updates. The exploitation of browser vulnerabilities through malicious extensions highlights the evolving tactics of cyber adversaries, emphasizing the need for continuous monitoring and robust security practices to protect sensitive information.
5 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports