Computer Software/Engineering
Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.
Explore Other Sectors
Computer Software/Engineering Threat Reports
Zero-Click Agentic Browser Attack Wipes Google Drive (Perplexity Comet, 2025)
In December 2025, researchers from Straiker STAR Labs disclosed a zero-click browser-based attack targeting users of Perplexity's Comet browser, enabling malicious actors to erase the contents of a victim’s entire Google Drive. The attack leverages agentic browser automation capable of connecting Gmail and Google Drive accounts by abusing trusted email-based automations. Once triggered by a specially crafted email, the exploit requires no user interaction to execute the destructive action. The compromise of cloud-stored data had significant operational impact, resulting in permanent data loss for affected users and highlighting new risks for organizations relying heavily on SaaS storage platforms. This attack is significant as it demonstrates the expanding threat of zero-click vulnerabilities powered by advanced browser automation, agentic AI, and email exploits. As more organizations migrate operations and collaborative data to the cloud, the frequency and sophistication of such attacks are expected to increase, escalating the urgency for robust cloud security controls.
8 months ago
Kill Chain
AutoIT3 Compiled Script Malware: 2024 Infostealer Surge Targets Windows Users
In December 2024, researchers identified a fresh malware campaign abusing compiled AutoIT3 scripts to deliver infostealers and remote access trojans to Windows systems. Attackers distributed malicious executables packaged in ZIP archives, which, upon execution, leveraged AutoIT3’s FileInstall() function to embed and unpack additional payloads, including obfuscated shellcode. Once unpacked, these scripts decoded and executed shellcode in memory, deploying threats such as Quasar RAT and Phantom Stealer, thereby enabling credential theft and system compromise for victim organizations. This campaign highlights a growing trend where attackers utilize low-profile development tools, like AutoIT, to evade traditional defenses and deliver sophisticated payloads. The resurgence of compiled script-based malware demonstrates ongoing innovation in attack vectors, requiring defenders to expand their monitoring to scripting environments and unpacked resource analysis.
8 months ago
Kill Chain
React2Shell: China-Nexus Groups Target Supply Chains with Critical React Vulnerability
In early 2024, a critical zero-day vulnerability in the widely used React JavaScript library—dubbed React2Shell—was actively exploited in the wild by sophisticated China-nexus threat actors. Attackers leveraged compromised software supply chains to infiltrate organizations during regular package updates, gaining access via vulnerable dependency injection into production environments. Once inside, adversaries orchestrated lateral movement to exfiltrate sensitive data and disrupt business operations across sectors, leveraging encrypted communication channels and advanced stealth techniques. The incident has underscored the significant risk posed by supply-chain weaknesses in core developer tools and frameworks, amplifying concerns among enterprises and regulators alike. This breach reflects a surge in supply-chain attacks targeting popular open-source components, exposing systemic vulnerabilities beyond traditional perimeter defenses. The rapid weaponization of techniques by nation-state actors highlights the urgent need for zero trust segmentation, proactive patching, and real-time threat visibility within software development ecosystems.
8 months ago
Kill Chain
Critical RCE in React Server Components Exposes Applications Worldwide (CVE-2025-55182)
In December 2025, a critical remote code execution (RCE) vulnerability—CVE-2025-55182—was discovered in the Flight protocol used by React Server Components. Rated CVSS 10.0, this flaw enabled unauthenticated attackers to craft malicious requests, resulting in the compromise of application servers running affected versions. Security researchers observed exploitation in the wild, with threat actors leveraging the flaw for lateral movement and potential data exfiltration. Organizations using Next.js and other frameworks integrating the vulnerable protocol faced heightened risk until urgent patches were issued. Immediate remediation efforts, threat monitoring, and network segmentation were necessary to mitigate the rapid spread. This incident underscores the increasing threat posed by supply chain vulnerabilities in widely adopted developer ecosystems. The exploitation of core component flaws in popular open-source projects amplifies business risk, as attackers accelerate adoption of frontline vulnerabilities for larger-scale impact.
8 months ago
Kill Chain
Meta React Server Components 2025: Critical RCE Vulnerability Added to CISA KEV
In December 2025, a critical remote code execution (RCE) vulnerability (CVE-2025-55182) was discovered and actively exploited in Meta's React Server Components framework. Threat actors leveraged this flaw in internet-exposed REACT instances, enabling them to execute arbitrary code remotely and potentially gain unauthorized access to internal systems. This vulnerability was significant enough to be added to CISA's Known Exploited Vulnerabilities (KEV) Catalog, prompting urgent remediation efforts across public and private organizations. Federal agencies were mandated to act by Binding Operational Directive 22-01, while industry peers were strongly advised to prioritize patching to limit exposure and prevent compromise. The exploit highlights an ongoing trend of attackers targeting widely adopted development frameworks like React, demonstrating how software supply chain and third-party vulnerabilities remain a high-risk vector. Its addition to the KEV Catalog underlines the persistent challenge organizations face in quickly identifying and mitigating critical threats across their infrastructure.
8 months ago
Kill Chain
Critical React2Shell Flaw in React & Next.js Puts Web Servers at Risk
In June 2024, a critical vulnerability known as 'React2Shell' was discovered in the React Server Components (RSC) 'Flight' protocol, impacting React and Next.js applications worldwide. This flaw enables unauthenticated remote code execution (RCE), allowing attackers to execute arbitrary JavaScript code on affected web servers. Security researchers observed that threat actors could exploit the protocol by sending crafted requests, potentially leading to a full compromise of application environments and exposure of sensitive data or further lateral movement within networks. This incident underscores heightened risk in modern web application supply chains and the urgent need for timely patching within frameworks. Growing attacks on open-source packages and widespread usage of React/Next.js frameworks amplify the incident's relevance, especially as application-layer vulnerabilities facilitate high-impact breaches at scale.
8 months ago
Kill Chain
How the yETH DeFi Platform Lost $9 Million in a Flash Loan Exploit (2025)
In December 2025, an unknown threat actor successfully exploited a critical vulnerability in the yETH DeFi platform's smart contract infrastructure, using advanced flash loan manipulation tactics to drain approximately $9 million in funds. The attack was executed within minutes, bypassing protocol controls and effectively emptying several liquidity pools. Investigators reveal that the breach exploited flawed logic in the contract that allowed multiple reentrancies and circumvented rate checks, leading to rapid unauthorized fund transfers. Remediation steps included pausing affected smart contracts and collaborating with exchanges to freeze stolen assets. This incident highlights the rapidly evolving threat landscape targeting decentralized finance (DeFi) ecosystems, where complex protocols and smart contract bugs can be weaponized for mass financial theft. Continued increases in such exploits have intensified regulatory and investor scrutiny while prompting the DeFi sector to emphasize real-time security visibility, automated incident response, and proactive contract auditing.
8 months ago
Kill Chain
Silver Fox Mimics Russian Tactics: Fake Teams Installer Pushes ValleyRAT in 2025 China Cyber Attack
In December 2025, the threat actor known as Silver Fox executed a targeted cyber campaign in China, distributing the ValleyRAT remote access trojan through a fake Microsoft Teams installer. By leveraging SEO-poisoned websites, attackers lured victims searching for legitimate collaboration apps into downloading malicious files disguised as authentic installers. Once executed, the malware provided the attackers with covert access and enabled data theft, surveillance, and potential lateral movement within targeted organizations. The campaign mimicked Russian threat actor behaviors as a false flag, complicating attribution and response. This incident highlights the increasing sophistication and frequency of social engineering attacks using trusted business tools as lures. The rise of targeted SEO poisoning, deceptive software installers, and identity obfuscation poses heightened risks for organizations handling sensitive data or operating in sensitive regions.
8 months ago
Kill Chain
Authorization Bypass in SolisCloud API Exposes Global Energy Data
In December 2025, the SolisCloud Monitoring Platform, widely used across the global energy sector, was found to have a critical API vulnerability that allowed authorization bypass via a user-controlled key. This flaw, tracked as CVE-2025-13932, permitted any authenticated user to manipulate API requests and access detailed plant data belonging to other customers by altering the plant_id parameter. The vulnerability, present in both API v1 and v2, exposed sensitive operational information and highlighted a significant risk of data leakage in cloud-hosted critical infrastructure platforms. No mitigation had been released by SolisCloud at the time of public disclosure. This incident underscores the heightened threat of insecure APIs in industrial control systems, coinciding with a broader increase in supply chain risks and attacks targeting energy infrastructure. Regulatory bodies are likely to intensify scrutiny, given the global deployment and criticality of such platforms in the energy sector.
8 months ago
Kill Chain
Critical React Flaw Puts Cloud Supply Chains at Immediate Risk
In June 2024, multiple severe vulnerabilities (CVSS 10.0) were discovered in the React JavaScript library, widely used by more than a third of cloud service providers. The flaws, which have been assigned two CVEs, could enable supply-chain attacks by allowing attackers to execute unauthorized code through compromised package updates or dependencies. If exploited, these vulnerabilities may lead to credential theft, lateral movement, and unauthorized access to sensitive cloud workloads, severely impacting the confidentiality and integrity of customer data. Cloud providers were urged to apply emergency patches and audit their environments for suspicious activity. This incident exemplifies the increasing risk posed by software supply-chain vulnerabilities, particularly as critical open-source components underpin cloud and enterprise infrastructures. The speed and scale of exploitation have raised concerns with regulators and CISOs, highlighting escalating threats to core cloud services and compliance programs.
8 months ago
Kill Chain
Critical Supply Chain React Vulnerability Puts Major Web Apps at Risk
In June 2025, a critical deserialization vulnerability (CVE-2025-55182) was discovered in React Server Components, an open-source project underpinning a vast ecosystem of web frameworks. The flaw, initially reported by security researcher Lachlan Davidson, allowed unauthenticated attackers to execute remote code in default configurations of major frameworks—most notably Next.js—and impacted about 39% of cloud environments using vulnerable packages. Meta, Vercel, and affected project maintainers issued emergency patches, with no exploitation observed before public disclosure, but technical details were widely circulated, causing industry-wide urgency for remediation. This incident demonstrates the growing risks associated with open-source supply chain dependencies and highlights how a single upstream vulnerability can propagate rapidly across major SaaS platforms and developer environments. The ease of exploitation and prevalence of the affected components elevate concerns about lateral movement, credential exposure, and long-tail risk in environments slow to update or lacking robust software composition analysis.
8 months ago
Kill Chain
Critical King Addons Elementor Plugin Flaw Exploited in WordPress Sites (CVE-2025-8489)
In early 2025, attackers began actively exploiting a critical privilege escalation flaw (CVE-2025-8489) in the King Addons for Elementor plugin on WordPress sites. By abusing an insecure registration process, threat actors were able to escalate privileges and gain administrative control over vulnerable sites without authorization. This access could be used to manipulate website content, add malicious backdoors, or exfiltrate sensitive data, impacting website owners' security and reputation. The attacks have been widespread due to the plugin's popularity and ease of exploitation, highlighting the persistent risks present in third-party WordPress extensions. This incident is particularly relevant as it exemplifies an ongoing wave of attacks targeting web application vulnerabilities in widely used CMS platforms. The proliferation of such zero-day exploits magnifies risk for organizations, especially as adversaries move quickly to weaponize flaws before patches are broadly applied.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports