Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Computer Software/Engineering

Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.

2541 threat reports
Page 164 of 212
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Computer Software/Engineering Threat Reports

Showing 1957–1968 / 2541 reports
Tudou Guarantee Shuts Down Telegram Transactions After $12B Crypto Fraud Wave
Financial Services9 months ago

Tudou Guarantee Shuts Down Telegram Transactions After $12B Crypto Fraud Wave

In January 2026, Tudou Guarantee Marketplace, a major Telegram-based platform known for facilitating illicit services and cryptocurrency fraud, halted its public Telegram transactions after processing over $12 billion in suspicious activity. This dramatic step followed the arrest of Chen Zhi, CEO of Prince Group, whose organization was linked to large-scale scam operations including forced labor, romance scams, and investment fraud. The sudden drop in wallet activity suggests a direct link to recent law enforcement action targeting Southeast Asian scam networks. This incident highlights the persistent risks of unregulated messaging platforms in enabling transnational cybercrime and the growing technological sophistication behind crypto-related fraud. With law enforcement crackdowns intensifying and marketplaces shifting tactics, organizations must update controls against social engineering, identity abuse, and crypto laundering.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Anthropic MCP Git Server Vulnerability: AI Supply Chain at Risk (2026)
Computer Software/Engineering9 months ago

Anthropic MCP Git Server Vulnerability: AI Supply Chain at Risk (2026)

In January 2026, three critical vulnerabilities were disclosed in Anthropic's official Model Context Protocol (MCP) Git server, a tool widely used for managing Git repositories programmatically via large language models (LLMs). The flaws—identified as CVE-2025-68143, CVE-2025-68144, and CVE-2025-68145—included two path traversal and one argument injection vulnerabilities. Attackers could exploit these bugs through prompt injection via malicious content (e.g., README files, poisoned issue descriptions) to access or overwrite arbitrary files and achieve remote code execution, without needing direct access to victim systems. Chained exploitation with Filesystem MCP enabled full system compromise until patched in late 2025. This incident highlights growing risks at the intersection of AI-driven development, supply chain dependencies, and insufficient input validation within reference implementations. As organizations increasingly rely on open-source AI tooling, securing both the application layer and its automation becomes vital in defending against evolving prompt-based and supply chain exploitation.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
North Korea Supply Chain Attack Exploits VS Code Projects – 2026 Analysis
Computer Software/Engineering9 months ago

North Korea Supply Chain Attack Exploits VS Code Projects – 2026 Analysis

In January 2026, cybersecurity researchers uncovered a sophisticated supply chain attack targeting software developers via malicious Visual Studio Code (VS Code) projects. Threat actors linked to North Korea's Contagious Interview campaign distributed weaponized VS Code samples to compromise developer endpoints and install covert backdoors. Once inside victims' systems, the attackers could move laterally, exfiltrate sensitive source code, and access development infrastructure, risking intellectual property, customer data, and supply chain integrity. The campaign represents an evolution of social engineering tactics and demonstrates the attackers’ focus on high-leverage targets within the tech sector. This incident is highly relevant as it underscores the growing trend of software supply chain attacks leveraging development environments and trusted open-source platforms. Organizations must now reassess third-party code risks and developer security, as attackers increasingly exploit toolchains and social-engineering techniques instead of perimeter defenses.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(low)
Read report
Chainlit AI Framework Under Fire: 2024 Vulnerabilities Expose Multicloud Risk
Computer Software/Engineering9 months ago

Chainlit AI Framework Under Fire: 2024 Vulnerabilities Expose Multicloud Risk

In 2024, critical vulnerabilities were uncovered in the Chainlit open-source AI chatbot framework, enabling attackers to exploit flaws in authentication and traffic encryption protections. Malicious actors could intercept unencrypted traffic, manipulate east-west communications, and abuse privileged access across multicloud deployments, potentially leading to data exfiltration or advanced lateral movement within enterprise environments. The incident highlighted how insecure defaults and lack of robust segmentation in AI frameworks expose companies to elevated risk, demanding urgent attention from organizations relying on these technologies for customer-facing or sensitive operations. This breach underscores a broader trend of threat actors targeting open-source AI platforms, taking advantage of immature security practices inherent to many machine learning deployments. As regulatory scrutiny and supply chain attacks surge, securing AI development and deployment pipelines is increasingly essential to prevent business disruption or compliance violations.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(low)
Read report
Critical RCE Flaws in Microsoft & Anthropic MCP Servers Expose AI Workloads to Cloud Takeover
Computer Software/Engineering9 months ago

Critical RCE Flaws in Microsoft & Anthropic MCP Servers Expose AI Workloads to Cloud Takeover

In early June 2024, researchers disclosed critical remote code execution (RCE) vulnerabilities in the Model Context Protocol (MCP) servers operated by Microsoft and Anthropic, exposing integral AI infrastructure to severe cloud takeover risks. Threat actors could leverage these flaws to execute arbitrary code and potentially gain privileged access to sensitive data or underlying cloud platforms, risking widespread lateral movement and data exfiltration. The vulnerabilities arose from insufficient encryption and a lack of east-west segmentation controls, enabling potential attackers to compromise interconnected AI workloads and services. Both vendors moved quickly to deploy patches, but the initial exposure window highlighted deep-seated risks in shared AI service architectures. This incident highlights growing adversary focus on AI model supply chains and service interconnects, with attackers exploiting new protocol vulnerabilities. Rising adoption of AI-driven services across industries has amplified attack surfaces, urging enterprises to enhance zero trust segmentation, encrypted traffic controls, and multicloud observability to meet evolving compliance and operational challenges.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(low)
Read report
Predator Bots Hit APIs at Scale: Are Your Defenses Ready for Autonomous Threats?
Financial Services9 months ago

Predator Bots Hit APIs at Scale: Are Your Defenses Ready for Autonomous Threats?

In 2024, a surge in highly sophisticated "predator bots" led to a large-scale wave of automated attacks targeting critical APIs across multiple industries. Threat actors leveraged AI-driven automation to mimic human behavior and evade detection, resulting in credential theft, fraudulent transactions, account takeovers, and widespread data scraping. The attacks exploited shadow APIs and business logic flaws, bypassed traditional defenses like IP filtering and CAPTCHAs, and drained significant revenue through scalping and abuse. The economic impact has been severe, with business losses estimated in the billions, and operational teams scrambling to regain visibility and control. This incident highlights the urgent need for modern, adaptive security that operates at machine speed. As attackers weaponize automation and AI, organizations face mounting pressure to implement layered defenses, proactive anomaly detection, and API-centric protection to prevent sophisticated fraud, data loss, and erosion of customer trust.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Ingram Micro 2025 Ransomware Breach: Over 42,000 Impacted in Supply Chain Attack
Information Technology/IT9 months ago

Ingram Micro 2025 Ransomware Breach: Over 42,000 Impacted in Supply Chain Attack

In July 2025, information technology distributor Ingram Micro experienced a significant ransomware attack that compromised its internal systems and resulted in the unauthorized access and potential theft of sensitive personal information for over 42,000 individuals. Attackers infiltrated the company’s network, deployed ransomware, and encrypted critical data, causing temporary disruption to business operations. Ingram Micro responded by shutting down affected systems, launching an investigation, and notifying impacted individuals, highlighting gaps in east-west traffic security and incident detection. This breach underscores the ongoing resurgence of ransomware attacks targeting supply chain companies and IT providers. With attackers refining lateral movement techniques, organizations face mounting pressure to adopt robust segmentation, real-time anomaly detection, and comprehensive data protection strategies in compliance with evolving regulatory expectations.

High impact

Kill Chain

ICInitial Compromise(low)
PEPrivilege Escalation(low)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Jordanian Access Broker Case Exposes Credential Sales Across 50 Enterprises
Financial Services9 months ago

Jordanian Access Broker Case Exposes Credential Sales Across 50 Enterprises

In May 2023, law enforcement identified Feras Khalil Ahmad Albashiti—a Jordanian national—operating as an initial access broker, selling unauthorized access to over 50 corporate networks via an underground cybercrime forum. Acting under the handle "r1z," Albashiti exchanged credentials for cryptocurrency on at least one occasion with an undercover officer, exposing illicit sales tied to fraud and abuse of privileged network access. Arrested in Georgia and extradited to the US in July 2024, he pleaded guilty to charges of fraud involving access credentials. Sentencing is scheduled for May 2026, with potential penalties of up to 10 years imprisonment and substantial fines. This case highlights the increasingly organized role of initial access brokers in cybercrime, where privileged access is sold to facilitate ransomware, espionage, and data theft. The incident underscores ongoing risks posed by the thriving market for stolen credentials used to compromise enterprise environments.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
How PDFSider Malware Enabled a Major Fortune 100 Ransomware Breach in Finance
Financial Services9 months ago

How PDFSider Malware Enabled a Major Fortune 100 Ransomware Breach in Finance

In January 2026, a Fortune 100 financial services company was compromised by a ransomware group utilizing a sophisticated new Windows malware strain dubbed PDFSider. Attackers used social engineering, posing as support staff to trick employees into running malicious files and installing remote-access tools. The payload was delivered via spearphishing emails containing a ZIP archive with a legitimate, signed PDF24 Creator executable and an altered cryptbase.dll, exploiting DLL side-loading to bypass security controls. Once activated, PDFSider established a covert backdoor, loaded its code into memory, and exfiltrated system information over encrypted DNS channels, employing advanced evasion and anti-analysis tactics to maintain persistent access and enable ransomware deployment. This incident underscores a surge in targeted ransomware and espionage-style operations, where attackers blend APT tradecraft with financial motives. As threats increasingly leverage trusted tools, memory-resident malware, and advanced encryption, organizations face mounting pressure to bolster detection and containment strategies in response to evolving attacker sophistication.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
NexShield Fake Ad Blocker & CrashFix: 2026's Browser Extension Malware
Financial Services9 months ago

NexShield Fake Ad Blocker & CrashFix: 2026's Browser Extension Malware

In January 2026, a sophisticated malvertising campaign leveraged a fake Chrome and Edge extension named NexShield to target corporate environments. Purported as a privacy-focused ad blocker, NexShield was distributed through the Chrome Web Store and social engineering tactics. Upon installation, the extension intentionally crashed browsers and subsequently displayed fake warnings instructing users to run malicious commands in Windows Command Prompt, thereby installing ModeloRAT—a Python-based remote access tool with extensive reconnaissance and persistence capabilities. The campaign, dubbed 'CrashFix' and attributed to threat actor KongTuke, demonstrated advanced evasion techniques, delayed payload execution, and targeted both corporate and individual users. This incident exemplifies the growing threat from malicious browser extensions and evolving malvertising techniques. Security experts note a marked increase in targeted, multi-stage attacks that exploit trusted distribution channels and leverage social engineering to compromise endpoints, underlining the urgent need for robust browser extension controls and ongoing user awareness.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
StackWarp: AMD’s Hardware Flaw Exposes Confidential Cloud VMs to Attack
Information Technology/IT9 months ago

StackWarp: AMD’s Hardware Flaw Exposes Confidential Cloud VMs to Attack

In January 2026, researchers disclosed a vulnerability called StackWarp, affecting AMD’s Zen 1 through Zen 5 processor lines, including EPYC models widely used in cloud and enterprise environments. The flaw (CVE-2025-29943) enables privileged threat actors on host servers to manipulate the stack pointer of guest memory in confidential virtual machines (CVMs) secured with AMD SEV-SNP. By exploiting a previously undocumented control bit, attackers can redirect program flow inside targeted VMs, leading to remote code execution, privilege escalation, and exposure of sensitive assets such as cryptographic keys or kernel privileges. AMD published mitigations and microcode updates in July and October 2025, with additional firmware patches pending. This incident is a compelling example of the persistent risks stemming from microarchitectural attacks bypassing virtualization and memory encryption boundaries. As supply chain, multi-tenant cloud, and confidential computing adoption increases, organizations should regularly assess hardware-layer exposures and stay current on firmware updates to limit high-impact cascades.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
CrashFix Chrome Extension Attack Delivers ModeloRAT in ClickFix-Style Campaign
Financial Services9 months ago

CrashFix Chrome Extension Attack Delivers ModeloRAT in ClickFix-Style Campaign

In January 2026, security researchers uncovered the 'KongTuke' campaign, which weaponized a malicious Chrome extension named CrashFix, disguised as an ad blocker. Attackers exploited a faux browser crash workflow—imitating ClickFix lures—to trick victims into running malicious commands, delivering the new ModeloRAT remote access trojan (RAT). The campaign allowed threat actors to silently gain persistent, covert access, facilitating lateral movement and potential data exfiltration within corporate environments. The incident highlights the evolving sophistication of browser-based attack chains and underscores browser extension risk as a modern threat vector for organizations reliant on SaaS and web apps. This breach is emblematic of a surge in malicious browser extensions delivering advanced malware. It showcases a growing trend toward supply chain compromise and the abuse of user trust in widely used browser platforms, calling for improved extension vetting and proactive security controls.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(low)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports