Computer Software/Engineering
Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.
Explore Other Sectors
Computer Software/Engineering Threat Reports
Critical Authentication Bypass Vulnerability Discovered in pac4j-jwt Java Library
In March 2026, a critical authentication bypass vulnerability (CVE-2026-29000) was discovered in the pac4j-jwt Java library, affecting versions prior to 4.5.9, 5.7.9, and 6.3.3. This flaw allows remote attackers to forge authentication tokens by exploiting improper verification of cryptographic signatures in the JwtAuthenticator component when processing encrypted JSON Web Tokens (JWTs). By crafting a JWE-wrapped PlainJWT with arbitrary subject and role claims, attackers can bypass signature verification and authenticate as any user, including administrators. ([arcticwolf.com](https://arcticwolf.com/resources/blog/cve-2026-29000/?utm_source=openai)) The vulnerability poses a significant risk due to the widespread use of pac4j-jwt in various Java applications and frameworks. Organizations utilizing affected versions are urged to upgrade to the latest fixed releases immediately to mitigate potential exploitation. ([arcticwolf.com](https://arcticwolf.com/resources/blog/cve-2026-29000/?utm_source=openai))
6 months ago
Kill Chain
Understanding LummaC2: The 2025 Advanced Evasion Malware
In 2025, LummaC2 emerged as a highly sophisticated information-stealing malware targeting Windows systems. Distributed through phishing emails, malicious advertisements, and compromised software, LummaC2 exfiltrated sensitive data, including browser credentials and cryptocurrency wallets. Notably, its v4.0 introduced advanced evasion techniques, such as trigonometry-based anti-sandbox mechanisms that detect human-like mouse movements to avoid detection. This evolution underscores a significant shift towards stealthy, persistent cyber threats that can bypass traditional security measures. The rise of LummaC2 highlights the increasing sophistication of malware-as-a-service platforms, enabling even low-skilled threat actors to deploy advanced attacks. Organizations must enhance their security postures by adopting proactive threat detection and response strategies to mitigate such evolving threats.
6 months ago
Kill Chain
Unveiling 'Zombie ZIP': A New Frontier in Malware Evasion
In March 2026, security researcher Chris Aziz unveiled a novel malware evasion technique termed 'Zombie ZIP.' This method involves manipulating ZIP file headers to mislead antivirus and endpoint detection systems into treating compressed malicious payloads as uncompressed data. Consequently, security tools scan the files without detecting the embedded threats. The technique proved effective against 50 out of 51 antivirus engines tested on VirusTotal. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-zombie-zip-technique-lets-malware-slip-past-security-tools/?utm_source=openai)) The emergence of 'Zombie ZIP' underscores the evolving sophistication of malware delivery methods, highlighting the need for enhanced detection mechanisms capable of identifying such deceptive techniques. Organizations must stay vigilant and update their security protocols to counteract these advanced evasion strategies.
6 months ago
Kill Chain
ShinyHunters Exploit Salesforce Experience Cloud Misconfigurations in 2026 Data Breach
In March 2026, Salesforce disclosed that the ShinyHunters cybercriminal group exploited misconfigured Experience Cloud sites to access sensitive data from approximately 100 high-profile companies. The attackers utilized a modified version of the open-source tool AuraInspector to identify and exploit overly permissive guest user configurations, enabling unauthorized data extraction. Salesforce emphasized that the breach resulted from customer misconfigurations rather than inherent platform vulnerabilities. This incident underscores the critical importance of adhering to security best practices when configuring cloud services. Misconfigurations can lead to significant data breaches, as demonstrated by the ShinyHunters' exploitation of Salesforce Experience Cloud sites. Organizations must regularly review and secure their cloud configurations to prevent unauthorized access and data exposure.
6 months ago
Kill Chain
Beware of 'InstallFix' Attacks: Fake Claude Code Sites Spreading Malware
In March 2026, a cyberattack campaign known as 'InstallFix' targeted developers by creating fake installation pages for Anthropic's Claude Code, an AI coding assistant. These counterfeit sites, promoted through Google-sponsored ads, closely mimicked legitimate pages and instructed users to execute malicious commands in their terminals. This led to the deployment of Amatera Stealer malware, which harvested sensitive information such as browser credentials and cryptocurrency wallets, potentially compromising enterprise development environments. This incident underscores the growing trend of attackers exploiting the widespread practice of copying and pasting commands from online sources. It highlights the urgent need for heightened vigilance and verification of software installation sources to prevent similar social engineering attacks.
6 months ago
Kill Chain
Critical Vulnerabilities in AI/ML Platforms: Lessons from the 2025 Security Breach
In mid-2025, a significant security vulnerability was discovered in three widely used open-source Python libraries—NeMo (by NVIDIA), Uni2TS (by Salesforce), and FlexTok (by Apple)—which are integral to various AI and ML platforms. These libraries, collectively downloaded over 10 million times via the HuggingFace platform, were found to execute arbitrary code embedded within model metadata, making them susceptible to remote code execution if exploited by attackers. The vulnerabilities were identified in April 2025 and resolved by July 2025, with corresponding CVEs assigned and severity scores ranging from 7.8 to 9.8 out of 10. As of December 2025, there have been no indications of these flaws being exploited in the wild. ([techradar.com](https://www.techradar.com/pro/security/python-libraries-used-in-top-ai-and-ml-tools-hacked-nvidia-salesforce-and-other-libraries-all-at-risk?utm_source=openai)) This incident underscores the critical importance of securing AI and ML infrastructure, especially as these technologies become increasingly integrated into business operations. The rapid adoption of AI tools without adequate security measures can expose organizations to significant risks, including data breaches and unauthorized access. It highlights the necessity for continuous monitoring, timely patching, and the implementation of robust security protocols to safeguard against emerging threats in the AI landscape.
6 months ago
Kill Chain
AdvJudge-Zero: Unveiling Critical Vulnerabilities in AI Judge Systems
In March 2026, Palo Alto Networks' Unit 42 researchers unveiled a critical vulnerability in AI 'judge' systems, which are large language models (LLMs) employed to enforce security policies and evaluate outputs. Utilizing a tool named AdvJudge-Zero, the researchers demonstrated that these AI judges could be manipulated through stealthy input sequences, a form of prompt injection, to bypass security controls. The attack exploits the models' decision-making processes, allowing unauthorized actions without detection. This vulnerability underscores the need for robust defenses against adversarial manipulations in AI systems. The discovery highlights the growing sophistication of prompt injection attacks, emphasizing the urgency for organizations to reassess and fortify their AI security measures. As AI integration deepens across industries, understanding and mitigating such vulnerabilities becomes paramount to maintaining trust and operational integrity.
6 months ago
Kill Chain
ShinyHunters' 2026 Exploitation of Salesforce Aura: A Wake-Up Call for Cloud Security
In March 2026, the cybercriminal group ShinyHunters initiated a series of data theft attacks targeting misconfigured Salesforce Experience Cloud instances. By exploiting excessive permissions granted to guest user profiles, the attackers accessed sensitive data without authentication. Utilizing a modified version of the AuraInspector tool, they identified and exploited these vulnerabilities, compromising approximately 300 to 400 organizations, many within the cybersecurity sector. The breaches led to unauthorized access to vast amounts of customer and corporate data, raising significant concerns about data security and privacy. This incident underscores the critical importance of proper configuration and access control in cloud platforms. Organizations are urged to audit guest user permissions, adhere to the principle of least privilege, and monitor for unusual access patterns to mitigate such risks. The event highlights the evolving tactics of threat actors and the necessity for continuous vigilance in cybersecurity practices.
6 months ago
Kill Chain
Google Cloud 2026: Surge in Vulnerability Exploitation
In the latter half of 2025, Google observed a significant shift in cloud attack vectors, with 44.5% of intrusions exploiting newly disclosed vulnerabilities in third-party software, while attacks leveraging weak credentials decreased to 27%. Notably, remote code execution flaws like React2Shell (CVE-2025-55182) and the XWiki vulnerability (CVE-2025-24893) were frequently targeted, with attackers deploying cryptominers within 48 hours of vulnerability disclosure. This trend underscores the urgency for organizations to promptly patch vulnerabilities and enhance their security posture to mitigate rapid exploitation risks. The accelerated exploitation of software vulnerabilities highlights the evolving tactics of threat actors and the necessity for organizations to adopt proactive vulnerability management and robust security measures to safeguard cloud environments against emerging threats.
6 months ago
Kill Chain
Chrome Extensions Compromised Post-Ownership Transfer: A 2026 Case Study
In February 2026, two Google Chrome extensions, QuickLens and ShotBird, were compromised following ownership transfers. The new owners introduced malicious updates that stripped security headers from HTTP responses, enabling code injection and data theft. These updates allowed attackers to execute arbitrary JavaScript, leading to the exfiltration of sensitive user data, including credentials and browsing history. The incident underscores the risks associated with browser extension supply chains and the potential for legitimate tools to become vectors for malware distribution. This event highlights the growing trend of attackers exploiting trusted browser extensions to infiltrate systems, emphasizing the need for vigilant monitoring of software supply chains and the implementation of robust security measures to detect and prevent such compromises.
6 months ago
Kill Chain
Malicious npm Package Poses as OpenClaw Installer, Deploys RAT on macOS
In early March 2026, a malicious npm package named '@openclaw-ai/openclawai' was discovered posing as an installer for OpenClaw. Uploaded on March 3, 2026, by a user named 'openclaw-ai', the package was downloaded 178 times before detection. Upon installation, it executed a postinstall script that deployed a remote access trojan (RAT) capable of stealing sensitive data, including system credentials, browser data, cryptocurrency wallets, SSH keys, Apple Keychain databases, and iMessage history. The malware also established persistence, allowing continuous remote access and data exfiltration. This incident underscores the growing trend of supply chain attacks targeting open-source ecosystems, exploiting the trust developers place in widely-used package managers like npm. The sophistication of the attack, including social engineering tactics and advanced persistence mechanisms, highlights the urgent need for enhanced security measures in software development pipelines.
6 months ago
Kill Chain
UNC4899's $1.5 Billion Cryptocurrency Heist: Lessons for the Industry
In February 2025, the North Korean state-sponsored hacking group UNC4899, also known as TraderTraitor, orchestrated a sophisticated cyberattack resulting in the theft of approximately $1.5 billion from the cryptocurrency exchange Bybit. The attackers compromised a developer's macOS workstation at Safe{Wallet}, a multisignature wallet platform, by deploying a malicious Docker project. This initial breach allowed them to hijack AWS session tokens, bypass multi-factor authentication, and inject malicious JavaScript into Safe{Wallet}'s application. Consequently, they manipulated a routine Ethereum transfer from Bybit's cold wallet to its hot wallet, redirecting the funds to addresses under their control. ([blog.it-expert.net](https://blog.it-expert.net/summaries/The-Feed_2025-03-10.html?utm_source=openai)) This incident underscores the escalating threat posed by state-sponsored cyber actors targeting the cryptocurrency sector. The use of advanced social engineering tactics, exploitation of cloud infrastructure vulnerabilities, and sophisticated supply chain attacks highlight the need for enhanced security measures and vigilance within the industry. ([thehackernews.com](https://thehackernews.com/2025/07/n-korean-hackers-used-job-lures-cloud.html?utm_source=openai))
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports