Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Computer Software/Engineering

Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.

2541 threat reports
Page 107 of 212
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Computer Software/Engineering Threat Reports

Showing 1273–1284 / 2541 reports
Grafana Labs' 2026 Security Breach: A Case Study in Credential-Based Attacks
Computer Software/Engineering5 months ago

Grafana Labs' 2026 Security Breach: A Case Study in Credential-Based Attacks

In May 2026, Grafana Labs, the developer of the popular open-source analytics platform, experienced a security breach when attackers exploited a stolen GitHub access token to download the company's source code. The extortion group known as CoinbaseCartel claimed responsibility, demanding a ransom to prevent the public release of the code. Grafana Labs promptly invalidated the compromised credentials, implemented additional security measures, and, adhering to FBI guidance, refused to pay the ransom. Importantly, the company confirmed that no customer data or personal information was accessed, and customer systems remained unaffected. This incident underscores the growing threat posed by credential-based attacks and the rise of data theft extortion tactics employed by groups like CoinbaseCartel. Organizations are reminded of the critical importance of securing access tokens and implementing robust security protocols to prevent unauthorized access and mitigate potential breaches.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
Leaked Shai-Hulud Malware Sparks New npm Infostealer Campaign
Computer Software/Engineering5 months ago

Leaked Shai-Hulud Malware Sparks New npm Infostealer Campaign

In May 2026, a threat actor using the alias 'deadcode09284814' published four malicious packages on the npm registry, embedding a non-obfuscated version of the Shai-Hulud malware. These packages targeted developer credentials, secrets, cryptocurrency wallet data, and account information. Notably, one package also transformed infected systems into bots for distributed denial-of-service (DDoS) attacks. The malicious packages included 'chalk-tempalte', '@deadcode09284814/axios-util', 'axois-utils', and 'color-style-utils'. Researchers at OXsecurity identified these uploads, highlighting the use of typosquatting techniques to deceive developers. The 'chalk-tempalte' package contained a direct clone of the Shai-Hulud malware, originally attributed to the TeamPCP hacker group, indicating that other actors are now leveraging the leaked source code. This incident underscores the persistent threat of supply chain attacks within the open-source ecosystem, emphasizing the need for developers to exercise caution when integrating third-party packages. The reuse of the Shai-Hulud malware by different threat actors highlights the rapid dissemination and adaptation of malicious tools, posing ongoing risks to software supply chains.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
SHub Reaper: Unveiling the Sophisticated macOS Infostealer
Financial Services5 months ago

SHub Reaper: Unveiling the Sophisticated macOS Infostealer

In May 2026, a new variant of the SHub macOS infostealer, dubbed 'Reaper,' emerged, employing sophisticated tactics to compromise systems. The malware masquerades as legitimate applications like WeChat and Miro, hosted on deceptive domains resembling trusted entities. Upon execution, it utilizes AppleScript to display a counterfeit Apple security update, prompting users to grant system access. Once infiltrated, Reaper exfiltrates sensitive browser data, documents containing financial information, and hijacks cryptocurrency wallet applications. Notably, it establishes persistence by installing scripts that mimic Google software updates, ensuring continuous access to the compromised system. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/shub-macos-infostealer-variant-spoofs-apple-security-updates/?utm_source=openai)) This incident underscores a concerning evolution in macOS-targeted malware, highlighting the increasing sophistication of threat actors in circumventing security measures. The use of trusted brand impersonation and legitimate system processes to deploy malware signifies a shift towards more deceptive and effective attack vectors, emphasizing the need for heightened vigilance and advanced security protocols among macOS users.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Red-Teaming Reveals Critical Vulnerabilities in Government Education AI Assistant
Government Administration5 months ago

Red-Teaming Reveals Critical Vulnerabilities in Government Education AI Assistant

In early 2026, a government-deployed AI assistant designed to handle education-related inquiries was subjected to a comprehensive red-teaming assessment. The evaluation revealed that, despite robust defenses against direct prompt injections and social engineering tactics, the AI system was vulnerable to structural manipulation techniques. Specifically, attackers successfully bypassed semantic filters by embedding malicious commands within JSON structures and utilizing Base64 encoding, leading the AI to generate unauthorized outputs, including phishing payloads and the disclosure of its own system prompts. These findings underscore the critical need for AI systems to implement multi-layered security measures that address both semantic and structural vulnerabilities to prevent exploitation through prompt injection attacks. The incident highlights the evolving nature of AI security threats, particularly the sophistication of prompt injection techniques that can circumvent traditional safeguards. As AI systems become increasingly integrated into sensitive sectors like education, it is imperative for organizations to adopt comprehensive security frameworks that encompass regular red-teaming exercises, advanced input validation, and continuous monitoring to detect and mitigate emerging threats effectively.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
SHub Reaper: A New macOS Threat Exploiting Trusted Brands
Computer Software/Engineering5 months ago

SHub Reaper: A New macOS Threat Exploiting Trusted Brands

In May 2026, a sophisticated macOS malware variant named SHub Reaper emerged, employing a multi-stage attack chain that impersonates trusted brands such as Apple, Google, and Microsoft. The malware is distributed through fake installers for applications like WeChat and Miro, hosted on typo-squatted domains resembling legitimate Microsoft sites. Upon execution, it masquerades as an Apple security update and establishes persistence via a fake Google Software Update directory. SHub Reaper is designed to steal sensitive information, including passwords, cryptocurrency wallets, and documents, while maintaining a backdoor for ongoing access. This incident underscores a growing trend of malware leveraging brand impersonation and social engineering to bypass traditional security measures. The use of legitimate-looking applications and trusted system processes highlights the need for enhanced vigilance and advanced detection mechanisms to protect against such evolving threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Malicious npm Packages Deliver Infostealers and DDoS Malware
Computer Software/Engineering5 months ago

Malicious npm Packages Deliver Infostealers and DDoS Malware

In May 2026, cybersecurity researchers identified four malicious npm packages—chalk-tempalte, @deadcode09284814/axios-util, axois-utils, and color-style-utils—containing infostealer malware and DDoS botnet functionality. These packages, published by the user deadcode09284814, were designed to steal sensitive information and facilitate distributed denial-of-service attacks. Notably, one package was a clone of the Shai-Hulud worm, previously leaked by TeamPCP. This incident underscores the escalating threat of supply chain attacks targeting developers through trusted repositories like npm. The discovery highlights the critical need for developers to exercise caution when integrating third-party packages, as attackers increasingly exploit public repositories to distribute malware. Implementing robust security measures, such as verifying package authenticity and monitoring for suspicious activity, is essential to mitigate the risks associated with supply chain compromises.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Critical Cybersecurity Incidents: Exchange 0-Day, npm Worm, and Cisco Exploit
Information Technology/IT5 months ago

Critical Cybersecurity Incidents: Exchange 0-Day, npm Worm, and Cisco Exploit

In May 2026, a series of significant cybersecurity incidents underscored the vulnerabilities in widely used systems and software. A zero-day vulnerability (CVE-2026-42897) in Microsoft Exchange Server was actively exploited, allowing attackers to execute arbitrary JavaScript via crafted emails, affecting on-premises deployments. Concurrently, the 'Mini Shai-Hulud' campaign compromised multiple npm packages, including those from TanStack and Mistral AI, embedding malicious code to steal credentials and potentially execute destructive actions. Additionally, a critical authentication bypass flaw (CVE-2026-20182) in Cisco Catalyst SD-WAN Controllers was exploited by threat actor UAT-8616 to gain unauthorized access and escalate privileges. These incidents highlight the escalating sophistication of supply chain attacks and the critical need for robust security measures across all software dependencies. Organizations must prioritize patching known vulnerabilities, implement stringent access controls, and continuously monitor for anomalous activities to mitigate the risks posed by such multifaceted threats.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Mini Shai-Hulud Attack: A Wake-Up Call for Developer Ecosystem Security
Computer Software/Engineering5 months ago

Mini Shai-Hulud Attack: A Wake-Up Call for Developer Ecosystem Security

Between April 29 and May 1, 2026, a coordinated supply chain attack known as "Mini Shai-Hulud" targeted multiple developer ecosystems, including npm, PyPI, and Docker Hub. The threat actor group TeamPCP injected malicious code into widely used packages such as SAP's Cloud Application Programming Model, PyTorch Lightning, and Intercom's npm package. This malware harvested sensitive credentials from developer environments and CI/CD pipelines, including GitHub tokens, cloud API keys, and SSH keys, by exfiltrating them to attacker-controlled repositories. The attack compromised over 170 packages, affecting millions of developers and organizations worldwide. ([labs.cloudsecurityalliance.org](https://labs.cloudsecurityalliance.org/research/csa-research-note-mini-shai-hulud-supply-chain-20260503-csa/?utm_source=openai)) This incident underscores the evolving nature of supply chain attacks, which now focus on developer workstations as entry points. The integration of malicious code into trusted packages highlights the need for enhanced security measures in the software development lifecycle, particularly in dependency management and CI/CD processes. Organizations must adopt comprehensive strategies to protect against such sophisticated threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Grafana GitHub Token Breach: Codebase Theft and Extortion Attempt in 2026
Computer Software/Engineering5 months ago

Grafana GitHub Token Breach: Codebase Theft and Extortion Attempt in 2026

In May 2026, Grafana Labs disclosed a security incident where an unauthorized party obtained a token granting access to the company's GitHub environment, enabling the download of its codebase. The attacker attempted to extort the company by demanding payment to prevent the public release of the stolen code. Grafana's investigation confirmed that no customer data or personal information was accessed, and there was no impact on customer systems or operations. The compromised credentials were invalidated, and additional security measures were implemented to prevent future unauthorized access. This incident underscores the persistent threat of supply chain attacks targeting software development environments. Organizations are increasingly facing sophisticated extortion attempts, highlighting the need for robust security practices, including vigilant monitoring of access credentials and comprehensive incident response plans.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
Critical Privilege Escalation Vulnerability in Microsoft Azure AKS Exposes Security Disclosure Challenges
Information Technology/IT5 months ago

Critical Privilege Escalation Vulnerability in Microsoft Azure AKS Exposes Security Disclosure Challenges

In March 2026, security researcher Justin O'Leary identified a critical privilege escalation vulnerability in Microsoft Azure Kubernetes Service (AKS). This flaw allowed users with the 'Backup Contributor' role to gain cluster-admin access without prior Kubernetes permissions. Despite reporting the issue to Microsoft on March 17, the company rejected the report on April 13, claiming the behavior was expected and did not constitute a security vulnerability. Subsequently, O'Leary escalated the matter to the CERT Coordination Center, which validated the vulnerability and assigned it the identifier VU#284781. However, Microsoft intervened to prevent the issuance of a CVE, maintaining that no product changes were necessary. This incident underscores the challenges in vulnerability disclosure processes and the importance of transparent communication between researchers and vendors to ensure the security of cloud services.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Claude Mythos: AI's Leap in Cybersecurity Threats
Computer Software/Engineering5 months ago

Claude Mythos: AI's Leap in Cybersecurity Threats

In April 2026, Anthropic unveiled Claude Mythos, an advanced AI model capable of autonomously identifying and exploiting thousands of high-severity vulnerabilities across major operating systems and web browsers. This AI demonstrated the ability to perform complex multi-step network attacks in significantly reduced timeframes, surpassing human capabilities in vulnerability discovery and exploitation. The emergence of such AI tools has raised substantial concerns within the cybersecurity community regarding the potential for accelerated cyberattacks and the need for enhanced defensive measures. The rapid advancement of AI in cybersecurity underscores the urgency for organizations to adapt their security strategies. Traditional defense mechanisms may no longer suffice against AI-driven threats, necessitating the adoption of automated defenses, improved vulnerability management, and architectural adaptations to mitigate the risks posed by these powerful AI capabilities.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
CI/CD Pipeline Attacks in 2025: Lessons Learned and Future Strategies
Computer Software/Engineering5 months ago

CI/CD Pipeline Attacks in 2025: Lessons Learned and Future Strategies

In 2025, a series of sophisticated cyberattacks targeted Continuous Integration and Continuous Deployment (CI/CD) pipelines, exploiting vulnerabilities within these automated software delivery systems. Attackers gained unauthorized access to build servers and developer environments, injecting malicious code that was seamlessly integrated into legitimate software releases. This method allowed adversaries to distribute malware widely, compromising numerous organizations and leading to significant data breaches and operational disruptions. The incidents underscored the critical need for enhanced security measures within CI/CD processes to prevent such supply chain attacks. These attacks highlight a growing trend where cybercriminals focus on the software supply chain, recognizing the potential to infiltrate multiple organizations through a single compromised pipeline. The increasing reliance on automated development tools necessitates a reevaluation of security protocols to safeguard against such pervasive threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports