✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Computer Software/Engineering
Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.
Explore Other Sectors
Computer Software/Engineering Threat Reports
1Campaign: The Cloaking Service Fueling Malicious Google Ads
In February 2026, cybersecurity researchers uncovered '1Campaign,' a sophisticated cloaking service that enables threat actors to run malicious Google Ads while evading detection. Managed by a developer known as 'DuppyMeister,' 1Campaign has been active for at least three years. The platform allows attackers to display benign content to security researchers and automated scanners, while serving malicious content to real users. This technique prolongs the lifespan of malicious ads, facilitating phishing and crypto-draining campaigns. The service offers a user-friendly dashboard for real-time visitor filtering based on geography, ISP, and device characteristics, effectively blocking over 99% of non-targeted traffic. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/1campaign-platform-helps-malicious-google-ads-evade-detection/?utm_source=openai)) The emergence of 1Campaign highlights a growing trend in cybercrime where attackers leverage advanced cloaking techniques to bypass traditional security measures. This development underscores the need for enhanced detection capabilities and adaptive security strategies to counteract increasingly sophisticated malvertising campaigns.
5 months ago
Kill Chain
Anthropic Uncovers Unauthorized Distillation Attacks by Chinese AI Firms in 2026
In February 2026, Anthropic, a U.S.-based AI company, reported that three Chinese AI firms—DeepSeek, Moonshot AI, and MiniMax—conducted large-scale distillation attacks to extract capabilities from its Claude AI model. These companies generated over 16 million interactions using approximately 24,000 fraudulent accounts, violating Anthropic's terms of service and regional access restrictions. The attacks focused on Claude's advanced features, including reasoning, coding, and tool use, aiming to enhance their own AI models without proper authorization. This incident underscores the escalating risks of intellectual property theft in the AI sector, particularly through distillation techniques. Such activities not only compromise proprietary technologies but also pose significant national security concerns, as models developed through illicit means may lack essential safety measures, potentially facilitating malicious applications.
5 months ago
Kill Chain
GitHub Codespaces 'RoguePilot' Vulnerability: A Wake-Up Call for AI Security
In February 2026, a critical vulnerability named 'RoguePilot' was discovered in GitHub Codespaces, allowing attackers to inject malicious instructions into GitHub issues. When developers launched a Codespace from such an issue, GitHub Copilot processed these hidden prompts, leading to unauthorized actions, including the exfiltration of sensitive data like the GITHUB_TOKEN. This flaw enabled potential repository takeovers and unauthorized code execution. Microsoft promptly patched the vulnerability following responsible disclosure. ([thehackernews.com](https://thehackernews.com/2026/02/roguepilot-flaw-in-github-codespaces.html?utm_source=openai)) This incident underscores the growing risks associated with integrating AI tools into development workflows, highlighting the need for robust security measures to prevent AI-driven supply chain attacks.
5 months ago
Kill Chain
Entra ID Applications Requesting Unexpected Permissions: A 2026 Security Alert
In early 2026, security researchers identified a significant vulnerability within Microsoft Entra ID, where certain applications were requesting unexpected and overly permissive access permissions. This issue arose due to misconfigurations in application consent settings, allowing applications to prompt users for extensive permissions without adequate oversight. Exploiting this flaw, threat actors could gain unauthorized access to sensitive organizational data, leading to potential data breaches and compliance violations. This incident underscores the critical importance of stringent application consent policies and regular audits of permission settings. As organizations increasingly adopt cloud-based identity solutions, ensuring that applications request only the necessary permissions is vital to maintaining security and compliance.
5 months ago
Kill Chain
Anthropic's Claude Model Targeted in Large-Scale AI Distillation Attack by Chinese Labs
In February 2026, Anthropic, a U.S.-based AI startup, reported that three Chinese AI laboratories—DeepSeek, Moonshot, and MiniMax—conducted large-scale 'distillation' attacks to extract capabilities from Anthropic's Claude model. These labs utilized 24,000 fraudulent accounts to send approximately 16 million requests to Claude, aiming to enhance their own AI models. This unauthorized extraction of intellectual property not only violated Anthropic's terms of service but also posed significant national security risks by potentially enabling offensive cyber operations and mass surveillance. ([cyberscoop.com](https://cyberscoop.com/anthropic-accuses-chinese-labs-ai-distillation-cyber-risk/?utm_source=openai)) This incident underscores the growing threat of AI model distillation as a method for intellectual property theft. The scale and sophistication of these attacks highlight the urgent need for robust security measures and regulatory frameworks to protect proprietary AI technologies from unauthorized exploitation.
5 months ago
Kill Chain
Optimizely's 2026 Data Breach: A Case Study in Vishing Attacks
In February 2026, Optimizely, a New York-based ad tech company, experienced a data breach initiated through a sophisticated voice phishing (vishing) attack. The attackers, identified as the ShinyHunters group, impersonated internal IT staff to deceive employees into divulging single sign-on (SSO) credentials and multi-factor authentication (MFA) codes. This social engineering tactic granted unauthorized access to Optimizely's systems, leading to the exfiltration of basic business contact information. The breach was confined to certain internal business systems, records in the customer relationship management (CRM) platform, and a limited set of internal documents used for back-office operations. There is no evidence that sensitive customer data or personal information beyond basic business contact information was accessed. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/ad-tech-firm-optimizely-confirms-data-breach-after-vishing-attack/?utm_source=openai)) This incident underscores a significant escalation in the operations of the ShinyHunters group, which has been actively targeting organizations through vishing attacks to compromise SSO credentials. The group's tactics have evolved to include harassment of victim personnel and other aggressive measures. ([itpro.com](https://www.itpro.com/security/google-issues-warning-over-shinyhunters-branded-vishing-campaigns?utm_source=openai))
5 months ago
Kill Chain
Security Flaws in Android Mental Health Apps Put Millions at Risk
In February 2026, security researchers identified significant vulnerabilities in several Android mental health applications, collectively downloaded over 14.7 million times from Google Play. These apps, designed to assist users with conditions such as depression and anxiety, were found to contain a total of 1,575 security flaws, including 54 high-severity and 538 medium-severity issues. Exploiting these vulnerabilities could allow attackers to intercept sensitive user data, including therapy session transcripts and personal health information, thereby compromising user privacy and confidentiality. This incident underscores the critical need for rigorous security measures in applications handling sensitive health data. The discovery highlights the potential risks associated with inadequate app security, emphasizing the importance of regular security assessments and compliance with data protection regulations to safeguard user information.
5 months ago
Kill Chain
PromptSpy AI Malware: Unveiling the Future of Android Cyber Threats
In February 2026, cybersecurity researchers identified 'PromptSpy,' the first known Android malware leveraging generative AI at runtime. This sophisticated malware utilizes Google's Gemini model to adapt its persistence mechanisms across various devices, enhancing its ability to evade detection. PromptSpy's discovery marks a significant evolution in mobile threats, demonstrating the integration of AI to dynamically modify malicious behavior during execution. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/promptspy-is-the-first-android-malware-to-use-generative-ai-at-runtime/?utm_source=openai)) The emergence of AI-driven malware like PromptSpy underscores a critical shift in cyber threats, where adversaries harness advanced technologies to create more resilient and adaptive attack vectors. This development necessitates a reevaluation of current security measures to effectively counteract AI-enhanced malicious activities.
5 months ago
Kill Chain
SANDWORM_MODE: A New Era of Supply Chain Attacks Targeting Developers
In February 2026, a sophisticated supply chain attack, dubbed SANDWORM_MODE, targeted the npm ecosystem by distributing at least 19 malicious packages. These packages were designed to harvest sensitive information, including system data, access tokens, environment secrets, and API keys from developer environments. The malware propagated by exploiting compromised npm and GitHub accounts, enabling widespread credential theft and unauthorized access to development infrastructures. Notably, the attack introduced a module that infiltrated AI coding assistants, extracting API keys from nine large language model providers and injecting malicious servers into tool configurations. This incident underscores the escalating complexity and reach of supply chain attacks, particularly those leveraging trusted open-source repositories. The integration of AI toolchain manipulation highlights a concerning evolution in attacker tactics, emphasizing the need for enhanced vigilance and security measures within development environments.
5 months ago
Kill Chain
Unveiling the Wormable XMRig Campaign: A Deep Dive into BYOVD Exploits and Time-Based Logic Bombs
In February 2026, cybersecurity researchers uncovered a sophisticated cryptojacking campaign that utilized pirated software bundles to deploy a customized XMRig miner on compromised systems. The malware exhibited worm-like capabilities, spreading via external storage devices, and employed a 'Bring Your Own Vulnerable Driver' (BYOVD) technique to escalate privileges. Additionally, it incorporated a time-based logic bomb set to deactivate the malware after December 23, 2025, indicating a planned operational timeframe. This campaign underscores the evolving tactics of cybercriminals, combining social engineering, legitimate software exploitation, and advanced persistence mechanisms to maximize cryptocurrency mining output. The use of BYOVD exploits and logic bombs highlights the need for robust security measures to detect and mitigate such multifaceted threats.
5 months ago
Kill Chain
React2Shell Exploitation 2025: A Wake-Up Call for Web Security
In December 2025, a critical vulnerability known as React2Shell (CVE-2025-55182) was disclosed in React Server Components, affecting versions 19.0 through 19.2.0. This flaw allowed unauthenticated remote code execution via crafted HTTP requests. Within hours of disclosure, state-sponsored threat actors, including Chinese groups Earth Lamia and Jackpot Panda, as well as North Korean operatives, began exploiting the vulnerability to deploy malware, establish persistent backdoors, and conduct cyber-espionage activities. The widespread use of React in web applications amplified the impact, leading to numerous system compromises across various sectors. ([aws.amazon.com](https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/?utm_source=openai)) The rapid exploitation of React2Shell underscores the increasing speed at which threat actors weaponize newly disclosed vulnerabilities. Organizations are urged to prioritize timely patching and enhance monitoring to mitigate risks associated with such critical flaws.
5 months ago
Kill Chain
North Korean IT Workers Exploit Remote Work to Infiltrate U.S. Companies in 2025
In 2025, U.S. authorities uncovered a sophisticated scheme where North Korean IT workers, using stolen or fabricated identities, secured remote positions within over 300 U.S. companies. These operatives, often based in China and Russia, infiltrated organizations by posing as legitimate American employees, thereby accessing sensitive corporate data and systems. The illicit earnings, estimated at over $88 million, were funneled back to North Korea to support its weapons programs. ([forbes.com](https://www.forbes.com/sites/alonzomartinez/2025/04/25/north-korean-hackers-pose-as-remote-workers-to-infiltrate-us-firms/?utm_source=openai)) This incident underscores the escalating threat of nation-state actors exploiting remote work vulnerabilities to bypass traditional security measures. The use of advanced tactics, including AI-generated profiles and deepfake technologies, highlights the need for enhanced identity verification processes and continuous monitoring of remote access points to safeguard organizational assets. ([fortune.com](https://fortune.com/2025/08/04/north-korean-it-worker-infiltrations-exploded/?utm_source=openai))
5 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports