Computer Software/Engineering
Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.
Explore Other Sectors
Computer Software/Engineering Threat Reports
Critical Vulnerability in Smart Slider 3 Plugin Affects 500K WordPress Sites
In March 2026, a critical vulnerability (CVE-2026-3098) was discovered in the Smart Slider 3 WordPress plugin, affecting versions up to 3.5.1.33. This flaw allows authenticated users, including those with minimal access like subscribers, to read arbitrary files on the server, including sensitive files such as wp-config.php. Exploitation of this vulnerability could lead to unauthorized access to database credentials and potential full site compromise. The issue arises from missing capability checks in the plugin's AJAX export actions, enabling any authenticated user to invoke them without proper validation. This incident underscores the persistent risks associated with plugin vulnerabilities in the WordPress ecosystem. With over 500,000 websites still running vulnerable versions of Smart Slider 3, it highlights the critical need for timely updates and robust security practices to mitigate potential exploits.
5 months ago
Kill Chain
Infinity Stealer: A New Threat to macOS Users
In March 2026, a new macOS-targeted malware named Infinity Stealer emerged, utilizing the ClickFix technique to deceive users into executing malicious code. The malware is delivered through fake CAPTCHA prompts that mimic Cloudflare's human verification, instructing users to paste a base64-obfuscated curl command into the macOS Terminal. This command downloads and executes a Python payload compiled with Nuitka, resulting in a native binary that is more resistant to static analysis. Once executed, Infinity Stealer performs anti-analysis checks and proceeds to exfiltrate sensitive data, including browser credentials, Keychain entries, cryptocurrency wallets, and plaintext secrets from developer files, via HTTP POST requests to a command-and-control server. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/02/02/infostealers-without-borders-macos-python-stealers-and-platform-abuse/?utm_source=openai)) The emergence of Infinity Stealer highlights a growing trend of sophisticated malware targeting macOS systems, leveraging advanced social engineering techniques and cross-platform development tools. This incident underscores the importance of user vigilance and the need for robust security measures to protect against evolving threats.
5 months ago
Kill Chain
Understanding the 2026 TeamPCP Supply Chain Attack
In March 2026, the cybercriminal group TeamPCP executed a sophisticated supply chain attack targeting multiple software packages and cloud services. The campaign began on March 19, 2026, with successive compromises of tools like Trivy, CanisterWorm, Checkmarx, LiteLLM, and Telnyx, occurring every 1-3 days. These attacks involved injecting malicious code into widely used software packages, enabling unauthorized access and data exfiltration from numerous downstream users. The rapid succession of these breaches highlighted the group's aggressive operational tempo and their focus on exploiting trusted software supply chains. As of March 28, 2026, a notable shift in TeamPCP's strategy was observed, with no new compromises reported in the preceding 48 hours. This pause suggests a transition from expanding their foothold to monetizing the vast trove of stolen credentials and data. The group's explicit intent to maintain a prolonged presence indicates that future supply chain attacks remain a significant threat. Organizations are advised to remain vigilant, conduct thorough security assessments, and implement robust monitoring to detect and mitigate potential breaches stemming from this campaign.
5 months ago
Kill Chain
Telnyx PyPI Supply Chain Attack: A 2026 Case Study
In March 2026, the Telnyx Python package on the Python Package Index (PyPI) was compromised by the threat actor TeamPCP. Malicious versions 4.87.1 and 4.87.2 were uploaded, embedding malware that exfiltrated sensitive data such as SSH keys, cloud tokens, and cryptocurrency wallets. The attack utilized steganography, hiding the payload within WAV audio files, and affected both Linux/macOS and Windows systems. This incident underscores the escalating threat of supply chain attacks targeting widely used open-source packages, emphasizing the need for enhanced security measures in software development pipelines.
5 months ago
Kill Chain
Fake VS Code Alerts on GitHub Distribute Malware to Developers
In March 2026, a large-scale campaign targeted developers on GitHub by posting fake Visual Studio Code (VS Code) security alerts in the Discussions sections of various projects. These deceptive posts, crafted as vulnerability advisories with titles like 'Severe Vulnerability - Immediate Update Required,' included fake CVE IDs and urgent language. Attackers impersonated real code maintainers or researchers to enhance credibility. The posts contained links to purportedly patched versions of VS Code extensions hosted on external services such as Google Drive. Clicking these links led to a redirection chain that executed a JavaScript reconnaissance script, collecting victims' system information and sending it to the attackers' command-and-control server. This campaign highlights the increasing sophistication of social engineering attacks targeting developers through trusted platforms. Similar tactics have been observed in previous incidents, such as the March 2025 phishing campaign that targeted 12,000 GitHub repositories with fake security alerts, leading to unauthorized access to developers' accounts and repositories. The recurrence of such attacks underscores the need for heightened vigilance and robust security practices within the developer community.
5 months ago
Kill Chain
Critical Security Vulnerabilities in LangChain and LangGraph: Immediate Action Required
In early 2026, multiple security vulnerabilities were identified in LangChain and LangGraph, two widely used open-source frameworks for building applications powered by Large Language Models (LLMs). These vulnerabilities include Server-Side Request Forgery (SSRF) in LangChain versions prior to 1.2.11, Regular Expression Denial-of-Service (ReDoS) in versions up to 0.3.1, and a critical Remote Code Execution (RCE) flaw in LangGraph's caching layer before version 4.0.0. Exploitation of these vulnerabilities could lead to unauthorized access to sensitive data, execution of arbitrary code, and potential system compromise. ([stack.watch](https://stack.watch/product/langchain-ai/langchain/?utm_source=openai)) The discovery of these vulnerabilities underscores the importance of rigorous security practices in the development and maintenance of AI frameworks. As LLM-powered applications become increasingly prevalent, ensuring the security of underlying frameworks is crucial to prevent potential exploitation by malicious actors.
5 months ago
Kill Chain
Open VSX Registry's 2026 GlassWorm Supply Chain Attack: A Wake-Up Call for Extension Security
In January 2026, the Open VSX Registry, a vendor-neutral extension marketplace for Visual Studio Code, experienced a significant supply chain attack. Threat actors compromised a legitimate publisher's account to distribute malicious updates to four popular extensions, collectively downloaded over 22,000 times. These updates deployed the GlassWorm malware, specifically targeting macOS users by exfiltrating sensitive data such as browser cookies, cryptocurrency wallets, and developer credentials. The malware utilized sophisticated evasion techniques, including locale checks and blockchain-based command-and-control mechanisms, to avoid detection and dynamically manage its infrastructure. ([securityweek.com](https://www.securityweek.com/open-vsx-publisher-account-hijacked-in-fresh-glassworm-attack/?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks within open-source ecosystems, highlighting the critical need for robust security measures in extension marketplaces. In response, the Eclipse Foundation, which maintains the Open VSX Registry, has announced plans to implement pre-publication security checks to proactively identify and mitigate malicious extensions before they reach users. ([thehackernews.com](https://thehackernews.com/2026/02/eclipse-foundation-mandates-pre-publish.html?utm_source=openai))
5 months ago
Kill Chain
TikTok Business Accounts Compromised in 2026 AiTM Phishing Attack
In March 2026, TikTok for Business accounts were targeted by adversary-in-the-middle (AiTM) phishing attacks. Cybercriminals employed sophisticated techniques to intercept user credentials and session cookies, effectively bypassing multi-factor authentication (MFA) measures. This allowed unauthorized access to business accounts, which were then exploited for malicious activities such as distributing malware and conducting fraudulent advertising campaigns. The attackers utilized deceptive emails and messages, directing users to counterfeit login pages that closely mimicked TikTok's official interface, thereby harvesting sensitive information. This incident underscores a growing trend in cyber threats where attackers leverage AiTM tactics to circumvent traditional security protocols, including MFA. The increasing prevalence of such sophisticated phishing methods highlights the need for organizations to adopt advanced security measures and continuous monitoring to protect against evolving cyber threats.
5 months ago
Kill Chain
TeamPCP's Malicious 'telnyx' PyPI Attack Exposes Supply Chain Vulnerabilities
In March 2026, the threat actor group TeamPCP executed a supply chain attack by uploading two malicious versions (4.87.1 and 4.87.2) of the 'telnyx' Python package to the Python Package Index (PyPI). These versions concealed credential-stealing malware within .WAV files, enabling the exfiltration of sensitive data from compromised systems. The attack underscores the vulnerability of open-source repositories to sophisticated supply chain compromises. This incident highlights the escalating trend of attackers targeting widely used open-source packages to distribute malware, emphasizing the need for enhanced vigilance and security measures in software supply chains.
5 months ago
Kill Chain
Unveiling the March 2026 Fraud Attack: Bot Signups and Account Takeovers
In March 2026, a sophisticated fraud campaign was identified, leveraging automated bots to create large volumes of fake accounts using compromised emails and residential proxies. These accounts, appearing legitimate, were later exploited for account takeovers through credential stuffing and phishing, leading to unauthorized transactions and data breaches. The attackers' use of automation and human-driven sessions allowed them to bypass traditional security measures, resulting in significant financial losses and reputational damage for affected organizations. This incident underscores the evolving nature of cyber threats, highlighting the need for multi-layered security approaches that integrate behavioral analytics, device fingerprinting, and real-time threat intelligence to detect and prevent such complex fraud schemes.
5 months ago
Kill Chain
Phishing Campaign Targets TikTok Business Accounts in 2026
In March 2026, a sophisticated phishing campaign targeted TikTok for Business accounts, exploiting their extensive reach and credibility. Attackers employed Cloudflare-hosted phishing pages, registered via NiceNIC, to impersonate TikTok's business services. Victims were lured through legitimate Google Storage URLs, which redirected them to malicious sites after bypassing security bots using Cloudflare Turnstile checks. These sites mimicked TikTok's 'Schedule a Call' pages, prompting users to enter business email addresses and login credentials. The attackers utilized reverse proxy techniques to capture credentials and session cookies, effectively bypassing two-factor authentication and enabling unauthorized access to accounts. This incident underscores the evolving tactics of cybercriminals in targeting high-profile business accounts for malicious activities. The campaign's sophistication, including the use of legitimate services to mask malicious intent and the ability to circumvent multi-factor authentication, highlights the need for enhanced vigilance and security measures among businesses utilizing social media platforms for marketing and outreach.
5 months ago
Kill Chain
Critical Langflow RCE Vulnerability (CVE-2026-33017) Exploited in the Wild
In March 2026, a critical remote code execution (RCE) vulnerability, identified as CVE-2026-33017, was discovered in Langflow, an open-source framework for building AI workflows. This flaw allows unauthenticated attackers to execute arbitrary Python code on affected servers by sending crafted HTTP requests to the unsandboxed flow execution endpoint. The vulnerability affects Langflow versions 1.8.1 and earlier, potentially leading to full system compromise, data theft, and unauthorized access to sensitive information. ([sentinelone.com](https://www.sentinelone.com/vulnerability-database/cve-2026-27966/?utm_source=openai)) The rapid exploitation of this vulnerability underscores the increasing targeting of AI development tools by threat actors. Organizations utilizing Langflow are urged to upgrade to version 1.9.0 or later, which addresses this security issue. Additionally, it is recommended to disable or restrict access to the vulnerable endpoint, monitor for suspicious activity, and rotate API keys and credentials to mitigate potential risks. ([sentinelone.com](https://www.sentinelone.com/vulnerability-database/cve-2026-27966/?utm_source=openai))
5 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports