Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Computer Software/Engineering

Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.

2541 threat reports
Page 120 of 212
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Computer Software/Engineering Threat Reports

Showing 1429–1440 / 2541 reports
Claude Mythos AI Enhances Firefox Security with 271 Vulnerability Fixes
Computer Software/Engineering6 months ago

Claude Mythos AI Enhances Firefox Security with 271 Vulnerability Fixes

In April 2026, Mozilla collaborated with Anthropic to utilize the advanced AI model, Claude Mythos, for a comprehensive security audit of Firefox. This partnership led to the identification and remediation of 271 vulnerabilities in Firefox 150, marking a significant advancement in AI-assisted cybersecurity. The vulnerabilities ranged from minor issues to critical flaws, all of which were addressed in the latest release. This initiative underscores the potential of AI in enhancing software security by rapidly detecting and mitigating vulnerabilities that might elude traditional methods. The success of this collaboration highlights a pivotal shift in cybersecurity, where defenders can leverage AI to gain a decisive advantage over potential threats. As AI tools become more sophisticated, their integration into security protocols is expected to become standard practice, offering a proactive approach to threat detection and resolution.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Vercel's 2026 Security Breach: A Wake-Up Call for Third-Party Integration Risks
Computer Software/Engineering6 months ago

Vercel's 2026 Security Breach: A Wake-Up Call for Third-Party Integration Risks

In April 2026, Vercel, a cloud development platform known for supporting frameworks like Next.js, experienced a security breach originating from a compromised third-party AI tool, Context.ai. An attacker exploited this tool to access a Vercel employee's Google Workspace account, subsequently infiltrating Vercel's internal systems. This led to unauthorized access to non-sensitive environment variables, posing potential risks to customer data. The breach underscores the vulnerabilities associated with interconnected systems and the importance of stringent access controls. ([vercel.com](https://vercel.com/kb/bulletin/vercel-april-2026-security-incident/?utm_source=openai)) This incident highlights the growing threat landscape where attackers leverage third-party integrations to gain unauthorized access to enterprise systems. Organizations must reassess their security postures, especially concerning third-party tools, to mitigate such risks effectively.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Exploring AI Security: The 'Otto Support' MCP Challenge
Computer Software/Engineering6 months ago

Exploring AI Security: The 'Otto Support' MCP Challenge

In April 2026, Bishop Fox introduced 'Otto Support,' a Capture-The-Flag (CTF) challenge designed to expose vulnerabilities in Model Context Protocol (MCP)-based AI systems. This hands-on exercise simulates real-world attack scenarios where AI assistants interact with tools, services, and local resources, highlighting potential security flaws in modern AI architectures. Participants are tasked with escalating privileges, exfiltrating data, and executing code, thereby uncovering how MCP-enabled systems can be exploited in practice. The relevance of this challenge is underscored by the rapid adoption of AI technologies and the corresponding emergence of new attack surfaces. As organizations integrate AI assistants into their operations, understanding and mitigating the security risks associated with MCP-based systems becomes imperative to prevent potential breaches and maintain trust in AI-driven processes.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Navigating the Cybersecurity Challenges of Frontier AI Models in 2026
Defense/Space6 months ago

Navigating the Cybersecurity Challenges of Frontier AI Models in 2026

In April 2026, the cybersecurity landscape witnessed a significant shift with the emergence of frontier AI models like Anthropic's Claude Mythos. These advanced AI systems demonstrated unprecedented capabilities in autonomously identifying and exploiting software vulnerabilities, effectively performing tasks that previously required extensive human expertise. The rapid development and deployment of such models have raised concerns about their potential misuse, as they can lower the barrier for launching sophisticated cyberattacks and accelerate the exploitation of vulnerabilities across critical infrastructures. ([weforum.org](https://www.weforum.org/stories/2026/04/anthropic-mythos-ai-cybersecurity/?utm_source=openai)) This development underscores the urgent need for organizations to reassess their cybersecurity strategies. The dual-use nature of frontier AI models means they can be harnessed for both defensive and offensive purposes, necessitating robust governance frameworks and collaborative efforts between AI developers, cybersecurity professionals, and policymakers to mitigate emerging risks and ensure the safe deployment of these powerful technologies. ([openai.com](https://openai.com/index/frontier-ai-regulation/?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
NASA Employees Targeted in Chinese Phishing Scheme
Defense/Space6 months ago

NASA Employees Targeted in Chinese Phishing Scheme

Between January 2017 and December 2021, Chinese national Song Wu orchestrated a sophisticated spear-phishing campaign targeting NASA, the U.S. military, universities, and private companies. By impersonating U.S. researchers and engineers, Wu successfully obtained sensitive aerospace software and source code, violating U.S. export control laws. The scheme led to unauthorized access to defense-related technologies, posing significant national security risks. In September 2024, Wu was indicted on multiple counts of wire fraud and aggravated identity theft but remains at large. This incident underscores the persistent threat of state-sponsored cyber espionage and the critical need for robust cybersecurity measures to protect sensitive information. Organizations must remain vigilant against increasingly sophisticated phishing tactics employed by foreign adversaries.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
Kaspersky Uncovers 26 Fake Crypto Wallet Apps on Apple App Store
Financial Services6 months ago

Kaspersky Uncovers 26 Fake Crypto Wallet Apps on Apple App Store

In April 2026, Kaspersky identified 26 fraudulent applications on the Apple App Store that impersonated popular cryptocurrency wallets such as MetaMask, Ledger, and Coinbase. These apps redirected users to phishing pages mimicking the App Store, leading to the installation of trojanized wallet applications designed to steal recovery phrases and private keys, thereby draining users' cryptocurrency holdings. The campaign, active since at least fall 2025, is attributed with moderate confidence to the threat actors behind SparkKitty. ([kaspersky.co.uk](https://www.kaspersky.co.uk/about/press-releases/kaspersky-finds-26-fake-crypto-wallet-apps-on-apples-app-store-that-can-drain-digital-assets?utm_source=openai)) This incident underscores the evolving sophistication of cyber threats targeting cryptocurrency users, highlighting the need for heightened vigilance and robust security measures. The exploitation of trusted platforms like the Apple App Store for distributing malicious apps signifies a concerning trend in cybercriminal tactics.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Tropic Trooper's 2026 Cyber Espionage Campaign: A Deep Dive
Computer Software/Engineering6 months ago

Tropic Trooper's 2026 Cyber Espionage Campaign: A Deep Dive

In March 2026, the advanced persistent threat group Tropic Trooper launched a targeted cyber espionage campaign against Chinese-speaking individuals in Taiwan, South Korea, and Japan. The attackers utilized a trojanized version of the SumatraPDF reader to deploy the AdaptixC2 Beacon agent, facilitating remote access through the abuse of Microsoft Visual Studio Code tunnels. This multi-stage attack began with military-themed document lures, leading to the execution of malicious payloads that established command and control channels via GitHub repositories. The campaign underscores the evolving tactics of Tropic Trooper, known for its focus on intelligence gathering in East Asia. This incident highlights the increasing sophistication of state-sponsored cyber threats, particularly in their use of legitimate tools and platforms to evade detection. Organizations must remain vigilant against such tactics, emphasizing the need for robust endpoint security, user education on phishing schemes, and continuous monitoring of network activities to detect and mitigate unauthorized access attempts.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
LMDeploy CVE-2026-33626: A Case Study in Rapid Vulnerability Exploitation
Computer Software/Engineering6 months ago

LMDeploy CVE-2026-33626: A Case Study in Rapid Vulnerability Exploitation

A high-severity Server-Side Request Forgery (SSRF) vulnerability, identified as CVE-2026-33626 with a CVSS score of 7.5, was discovered in LMDeploy, an open-source toolkit for compressing, deploying, and serving large language models (LLMs). This flaw resides in the vision-language module's `load_image()` function, which fetches arbitrary URLs without validating internal or private IP addresses, potentially allowing attackers to access cloud metadata services, internal networks, and sensitive resources. The vulnerability affects all versions up to 0.12.2 and was patched in version 0.12.3. Notably, within 13 hours of its public disclosure, the vulnerability was actively exploited in the wild, with attackers targeting AWS Instance Metadata Service (IMDS) and Redis instances, testing egress with out-of-band DNS callbacks, and performing port scans on the loopback interface. This rapid exploitation underscores the critical need for prompt vulnerability management and patching practices. The incident highlights a concerning trend where threat actors swiftly weaponize newly disclosed vulnerabilities, particularly in AI infrastructure components, emphasizing the importance of proactive security measures and continuous monitoring to mitigate potential risks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Lazarus Group's 'ClickFix' Campaign: A Wake-Up Call for macOS Security
Financial Services6 months ago

Lazarus Group's 'ClickFix' Campaign: A Wake-Up Call for macOS Security

In April 2026, North Korea's Lazarus Group initiated a cyberattack campaign targeting macOS users in the fintech and cryptocurrency sectors. Utilizing a social engineering technique known as 'ClickFix,' attackers impersonated trusted contacts to send fake online meeting invitations via platforms like Telegram. Victims were deceived into executing malicious commands in their macOS Terminal, leading to the installation of a malware toolkit named 'Mach-O Man.' This malware facilitated credential theft, system profiling, and data exfiltration, compromising corporate systems and financial resources. This incident underscores the evolving sophistication of state-sponsored cyber threats, particularly against macOS platforms previously considered less vulnerable. The use of social engineering tactics like ClickFix highlights the critical need for organizations to enhance user awareness and implement robust security measures to mitigate such deceptive attack vectors.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Project Glasswing: AI's Role in Transforming Cybersecurity
Information Technology/IT6 months ago

Project Glasswing: AI's Role in Transforming Cybersecurity

In April 2026, Anthropic launched Project Glasswing, an initiative leveraging its advanced AI model, Claude Mythos Preview, to identify and remediate critical software vulnerabilities. Collaborating with major tech companies like AWS, Apple, Cisco, CrowdStrike, Google, Microsoft, and Palo Alto Networks, the project uncovered thousands of zero-day vulnerabilities across major operating systems and browsers, including a 27-year-old OpenBSD flaw and a 16-year-old FFmpeg bug. This initiative underscores the shift from traditional enumeration-based security tools to AI-driven analysis capable of understanding code intent and relationships, thereby identifying flaws that eluded conventional methods. The significance of Project Glasswing lies in its demonstration of AI's potential to revolutionize cybersecurity by proactively detecting and addressing vulnerabilities before they can be exploited. This proactive approach is crucial in an era where attackers increasingly leverage sophisticated tools, including AI, to identify and exploit security weaknesses. Organizations must adapt to this evolving threat landscape by integrating AI-driven security solutions to enhance their defensive capabilities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
ADT Data Breach 2026: Lessons in SSO Security
Security/Investigations6 months ago

ADT Data Breach 2026: Lessons in SSO Security

In April 2026, home security company ADT experienced a data breach orchestrated by the ShinyHunters extortion group. The attackers gained unauthorized access to ADT's systems through a voice phishing (vishing) attack, compromising an employee's Okta single sign-on (SSO) account. This access allowed them to infiltrate ADT's Salesforce instance and exfiltrate personal information, including names, phone numbers, addresses, and, in some cases, dates of birth and partial Social Security numbers. Notably, no payment information or customer security systems were affected. ADT promptly terminated the intrusion, launched an investigation, and notified all affected individuals. This incident underscores the escalating threat posed by sophisticated social engineering attacks targeting SSO credentials. Organizations must enhance their security awareness training and implement robust multi-factor authentication protocols to mitigate such risks.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
In-Depth Analysis of the 2026 Axios npm Supply Chain Attack
Computer Software/Engineering6 months ago

In-Depth Analysis of the 2026 Axios npm Supply Chain Attack

In March 2026, attackers compromised the npm account of a lead maintainer of Axios, a widely-used JavaScript HTTP client library with over 100 million weekly downloads. They released two malicious versions of the package—axios@1.14.1 and axios@0.30.4—which included a trojan-laden dependency named 'plain-crypto-js'. This rogue package executed a post-installation script that downloaded and installed a cross-platform Remote Access Trojan (RAT) targeting macOS, Windows, and Linux systems. The malware connected to a command-and-control server, deployed system-specific payloads, and erased its tracks to evade detection. The malicious versions were available for approximately two to three hours before being removed from the npm registry. ([tomshardware.com](https://www.tomshardware.com/tech-industry/cyber-security/axios-npm-package-compromised-in-supply-chain-attack-that-deployed-a-cross-platform-rat?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks within the open-source ecosystem. The rapid deployment and widespread use of compromised packages highlight the need for enhanced security measures in software development pipelines. Organizations are urged to implement stringent access controls, conduct regular audits of dependencies, and monitor for unusual activity to mitigate the risks associated with such attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports