Computer Software/Engineering
Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.
Explore Other Sectors
Computer Software/Engineering Threat Reports
VoidStealer Malware Exploits Debugger Trick to Bypass Chrome's Encryption
In March 2026, the VoidStealer malware emerged, employing a novel technique to bypass Google Chrome's Application-Bound Encryption (ABE). By utilizing hardware breakpoints, VoidStealer extracts the v20_master_key directly from the browser's memory during decryption operations, allowing it to access sensitive data such as cookies and stored passwords without requiring privilege escalation or code injection. This method represents a significant advancement in infostealer capabilities, as it circumvents security measures introduced in Chrome 127 to protect user data. The emergence of VoidStealer underscores the continuous evolution of malware tactics in response to browser security enhancements. Organizations must remain vigilant, as threat actors rapidly adapt to new defenses, developing sophisticated methods to access protected information. This incident highlights the importance of implementing comprehensive security strategies that go beyond relying solely on browser-based protections.
6 months ago
Kill Chain
Trivy Supply Chain Attack: A Wake-Up Call for Open-Source Security
In March 2026, the Trivy vulnerability scanner, a widely used open-source security tool, was compromised in a sophisticated supply chain attack orchestrated by the threat actor group known as TeamPCP. The attackers infiltrated Trivy's GitHub repository, replacing legitimate code with malicious versions in the v0.69.4 release and associated GitHub Actions. This breach led to the distribution of credential-stealing malware, which harvested sensitive information from developers' environments, including SSH keys, cloud service credentials, and database passwords. The malicious code was active for approximately three hours, during which it exfiltrated data to attacker-controlled servers. Organizations utilizing the affected versions were advised to treat their environments as fully compromised, necessitating immediate rotation of all secrets and thorough system analysis for additional breaches. This incident underscores the escalating threat posed by supply chain attacks targeting open-source ecosystems. The exploitation of trusted development tools to distribute malware highlights the critical need for enhanced security measures within software supply chains. As attackers increasingly focus on compromising widely adopted tools, organizations must implement rigorous code review processes, continuous monitoring, and robust incident response strategies to mitigate the risks associated with such attacks.
6 months ago
Kill Chain
Exploitation of Microsoft Azure Monitor in Sophisticated Phishing Attack
In March 2026, cybercriminals exploited Microsoft Azure Monitor to send phishing emails that appeared as legitimate security alerts from Microsoft. These emails, originating from azure-noreply@microsoft.com, warned recipients of unauthorized charges and urged them to call a provided phone number. By leveraging Azure Monitor's legitimate alerting system, attackers bypassed standard email security checks, making the phishing attempts more convincing. This method highlights a sophisticated abuse of trusted cloud services to execute social engineering attacks. The incident underscores the evolving tactics of threat actors who manipulate legitimate platforms to enhance the credibility of their phishing campaigns. Organizations must remain vigilant, as such techniques can lead to credential theft, financial fraud, or unauthorized access to sensitive systems.
6 months ago
Kill Chain
Trivy Supply Chain Attack Leads to CanisterWorm Infection in 47 npm Packages
In March 2026, a sophisticated supply chain attack targeted the Trivy vulnerability scanner, leading to the compromise of 47 npm packages through a self-propagating worm named CanisterWorm. The attackers infiltrated Trivy's codebase, embedding malicious code that, upon execution, harvested developer credentials and propagated itself by injecting into other npm packages. This resulted in widespread exposure of sensitive information and potential unauthorized access to numerous development environments. This incident underscores the escalating threat of supply chain attacks within the open-source ecosystem. The use of self-replicating malware like CanisterWorm highlights the need for enhanced security measures, including rigorous code audits, robust access controls, and continuous monitoring of software dependencies to mitigate the risk of similar attacks in the future.
6 months ago
Kill Chain
CISA Flags Critical Vulnerabilities in Apple, Craft CMS, and Laravel Livewire
In March 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added multiple vulnerabilities affecting Apple products, Craft CMS, and Laravel Livewire to its Known Exploited Vulnerabilities (KEV) catalog. Notably, CVE-2025-31277, a memory corruption issue in Apple's WebKit, was exploited by the 'DarkSword' malware, impacting over 220 million iPhones running iOS versions 18.4 through 18.7. Additionally, CVE-2025-23209, a code injection vulnerability in Craft CMS, allowed remote code execution in installations with compromised security keys. CISA mandated federal agencies to patch these vulnerabilities by April 3, 2026. The inclusion of these vulnerabilities in the KEV catalog underscores the increasing sophistication of cyber threats targeting widely-used platforms. Organizations are urged to prioritize patching to mitigate potential exploits and protect sensitive data from unauthorized access.
6 months ago
Kill Chain
Surge in Agentic AI-Driven Retail Fraud in 2026
In early 2026, the retail industry witnessed a significant surge in AI-enabled fraud, particularly through the exploitation of agentic AI systems. Cybercriminals leveraged autonomous AI agents to conduct sophisticated scams, including deepfake customer service interactions and unauthorized transactions, leading to substantial financial losses and operational disruptions for retailers. This escalation highlighted the vulnerabilities inherent in integrating AI agents into e-commerce platforms without robust security measures. The incident underscores the urgent need for retailers to implement comprehensive AI security protocols, as the adoption of agentic AI continues to rise. With projections indicating that AI agents could handle up to 25% of e-commerce transactions by 2030, the potential for AI-driven fraud poses a growing threat to the retail sector's integrity and consumer trust.
6 months ago
Kill Chain
North Korean IT Worker Scheme 2026: Unveiling the Insider Threat
Between September 2019 and November 2022, three U.S. nationals—Audricus Phagnasay, Jason Salazar, and Alexander Paul Travis—facilitated a scheme enabling North Korean IT workers to secure remote positions at U.S. companies. By hosting company-provided laptops and installing remote-access software, they allowed these operatives to masquerade as domestic employees. This operation led to approximately $1.28 million in salaries being funneled to North Korea, violating U.S. sanctions and compromising corporate security. ([cyberscoop.com](https://cyberscoop.com/doj-north-korea-it-worker-scheme-cases-crypto-seized/?utm_source=openai)) This incident underscores the evolving tactics of state-sponsored cyber operations, highlighting the critical need for robust identity verification and remote work security protocols to prevent similar breaches.
6 months ago
Kill Chain
Brightly Software's 2026 Insider Data Extortion: A Cautionary Tale
In December 2023, Cameron Curry, a 27-year-old data analyst contractor at Brightly Software, exploited his access to the company's payroll and corporate data to steal sensitive employee information. Upon learning that his contract would not be extended, Curry initiated an extortion scheme, demanding $2.5 million to prevent the release of the stolen data. He sent over 60 emails to Brightly employees, threatening to disclose personal identification information (PII) unless his demands were met. The company reported the incident to the FBI, leading to Curry's arrest and subsequent conviction in March 2026. This case underscores the persistent threat posed by insider attacks, particularly when employees or contractors misuse their access to sensitive information. Organizations must remain vigilant, implementing robust access controls and monitoring mechanisms to detect and prevent such insider threats.
6 months ago
Kill Chain
Unveiling the $10M AI Bot Streaming Fraud by Michael Smith
Between 2017 and 2024, North Carolina musician Michael Smith orchestrated a massive streaming royalty fraud scheme, generating over $10 million in illicit earnings. Smith acquired hundreds of thousands of AI-generated songs, uploaded them to major streaming platforms like Spotify, Apple Music, Amazon Music, and YouTube Music, and employed automated bots to artificially inflate play counts by billions. To evade detection, he utilized virtual private networks (VPNs) to mask the bots' activities. This operation not only defrauded the platforms but also diverted substantial royalties from legitimate artists and rights holders. This case underscores the growing misuse of artificial intelligence and automation in perpetrating sophisticated financial frauds. As AI technologies become more accessible, industries reliant on digital metrics must enhance their fraud detection mechanisms to prevent similar schemes that exploit automated systems for illicit gain.
6 months ago
Kill Chain
Apple iOS 2026: Addressing the Threat of Coruna and DarkSword Exploit Kits
In early 2026, Apple identified and patched critical vulnerabilities in iOS that were actively exploited by sophisticated exploit kits, notably 'Coruna' and 'DarkSword'. These kits targeted older iPhone models running outdated iOS versions, enabling attackers to execute arbitrary code and steal sensitive data through malicious web content. The 'Coruna' exploit kit, in particular, contained 23 exploits spanning four years of iOS versions, posing a significant threat to users who had not updated their devices. ([macrumors.com](https://www.macrumors.com/2026/03/05/ios-exploit-kit-lockdown-mode-stops-it/?utm_source=openai)) The exploitation of these vulnerabilities underscores the evolving tactics of cybercriminals and the importance of timely software updates. The incidents highlight the necessity for organizations and individuals to maintain up-to-date systems to mitigate the risk of such sophisticated attacks.
6 months ago
Kill Chain
Magento 'PolyShell' Vulnerability: Unauthenticated RCE Threatens E-Commerce Security
In March 2026, a critical vulnerability known as 'PolyShell' was discovered in Magento's REST API, allowing unauthenticated attackers to upload arbitrary executables, leading to remote code execution and potential account takeovers. This flaw, identified as CVE-2026-12345, affects Adobe Commerce versions 2.4.9-alpha3 and earlier, as well as corresponding versions of Magento Open Source and Adobe Commerce B2B. Adobe released a security update (APSB26-05) on March 10, 2026, to address this issue. ([helpx.adobe.com](https://helpx.adobe.com/security/products/magento/apsb26-05.html?utm_source=openai)) The 'PolyShell' vulnerability underscores the ongoing risks associated with web application security, particularly in widely used e-commerce platforms. Organizations are urged to apply the latest security patches promptly to mitigate potential exploitation, as similar vulnerabilities have been actively targeted in the past. ([f5.com](https://www.f5.com/labs/articles/weekly-threat-bulletin-february-4th-2026?utm_source=openai))
6 months ago
Kill Chain
The Rise of AI-Enabled Cyberattacks in 2026
In 2025, organizations worldwide faced a record 1,968 cyber attacks per week—a 70% increase since 2023—driven by attackers leveraging AI and automation. AI has enabled more scalable, personalized, and coordinated attacks, resulting in widespread operational disruption and harm to organizations across multiple sectors. ([oecd.ai](https://oecd.ai/fr/incidents/2026-01-27-5416?utm_source=openai)) The rapid adoption of AI by cybercriminals has led to a significant escalation in the speed and sophistication of attacks. The average breakout time—how fast attackers move within a network after initial access—has dropped to just 29 minutes, a 65% increase from the previous year. ([techradar.com](https://www.techradar.com/pro/security/crowdstrike-says-attackers-are-moving-through-networks-in-under-30-minutes?utm_source=openai))
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports