Computer Software/Engineering
Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.
Explore Other Sectors
Computer Software/Engineering Threat Reports
GitHub Copilot CamoLeak: AI Attack Demonstrates Exfiltration Risk in 2024
In early 2024, cybersecurity researchers disclosed a proof-of-concept (PoC) called 'CamoLeak' demonstrating a novel attack vector exploiting GitHub Copilot’s AI code completion capability for data exfiltration. The PoC showed how sensitive code snippets and secrets could be extracted from Copilot instances by crafting malicious prompts that trick the AI into leaking previously seen proprietary content. While GitHub employs robust internal mitigations, the research exposes significant risks for organizations integrating generative AI tools into development workflows, particularly where prompt and response data may be inadequately secured. This incident underscores the rapid evolution of attack techniques targeting GenAI platforms and highlights emergent threats of data leakage through AI-driven automation. As enterprises increasingly leverage AI coding assistants, understanding and mitigating AI-enabled exfiltration vectors is key to upholding governance, compliance, and intellectual property security.
8 months ago
Kill Chain
Feds Dismantle ShinyHunters' Salesforce Extortion Hub: Lessons for Cloud Security
In June 2024, U.S. federal authorities dismantled an extortion portal run by the notorious ShinyHunters group, which was used to threaten Salesforce victims after a reported compromise. ShinyHunters is known for data theft and double-extortion tactics, leveraging public leaks and ransom demands to extort organizations. Despite law enforcement takedown efforts, the group's threats remain active, targeting businesses that rely on Salesforce for their customer and operational data. The attack highlights risks surrounding third-party SaaS platforms and sophisticated cybercriminal techniques that exploit sensitive, cloud-based systems for extortion. This event underscores the accelerating landscape of data extortion and the persistent threat from established ransomware and data-leak actors. As organizations increasingly depend on SaaS providers, regulators and enterprises are intensifying focus on zero trust access, east-west traffic security, and layered controls to contain lateral movement and prevent sensitive data exposure.
8 months ago
Kill Chain
Harvard University Breached by Clop Ransomware: Oracle Zero-Day Attack Exposes Data
In the first half of 2024, Harvard University fell victim to a significant cyberattack orchestrated by the Clop ransomware group, exploiting a zero-day vulnerability in Oracle software. The threat actors gained unauthorized access to sensitive university data, exfiltrating large volumes as part of a broader campaign that targeted Oracle customers worldwide. The breach showcases how sophisticated ransomware groups leverage software supply chain weaknesses, often exploiting vulnerabilities before patches become available. As a result, Harvard faced disruption of operations, regulatory scrutiny, and potential exposure of sensitive academic and financial data. This incident underscores the escalating trend of ransomware operations exploiting zero-day flaws to target major institutions, particularly in the education sector. The attack highlights urgent needs for advanced segmentation, rapid patching, and proactive lateral movement prevention as ransomware groups become more aggressive and opportunistic.
8 months ago
Kill Chain
Microsoft VS Code Marketplace Plugins Leak Sensitive Secrets: Supply Chain Alert
In early 2024, security researchers uncovered over 550 unique authentication secrets (such as API keys and credentials) leaking from extensions published on Microsoft's Visual Studio Code Marketplace. The exposed secrets, embedded within third-party extensions, created a major supply chain risk by potentially allowing attackers to compromise developer environments or escalate access to sensitive systems. Microsoft responded by enhancing its security review process, warning affected publishers, and initiating additional controls to prevent similar exposures in the future. This incident highlights the growing risks tied to open software ecosystems, where attackers increasingly target supply chain dependencies. With developer tools and plugin marketplaces at the core of modern workflows, secret leakage could enable widespread compromise, pushing organizations to urgently strengthen code supply chain security and compliance.
8 months ago
Kill Chain
GlassWorm: A Self-Propagating Supply Chain Worm Targets VS Code Developers
In early 2024, a sophisticated supply chain attack targeting the Visual Studio Code (VS Code) developer ecosystem was uncovered, leveraging a self-propagating worm dubbed 'GlassWorm.' The attack exploited weaknesses in package distribution and dependency validation, spreading rapidly via malicious code hidden in open-source extensions and packages. Once executed on developer machines, GlassWorm covertly harvested credentials and turned compromised systems into nodes for broader criminal infrastructure, affecting nearly 36,000 endpoints globally. The incident illuminated the risks posed by highly automated, invisible code propagation through trusted development tools, impacting developer productivity and increasing the potential for downstream compromise across organizations that rely on shared code repositories. This breach is emblematic of the accelerating trend of supply chain attacks against development environments, with threat actors increasingly leveraging automation and legitimate software to undermine trust. The GlassWorm incident underscores the urgency for enhanced visibility, stringent code validation, and zero trust controls in modern software supply chains to counter evolving adversary tactics.
8 months ago
Kill Chain
Remote Code Execution Flaw in Abandoned Rust Library Exposes Global Supply Chain
In August 2024, Edera researchers discovered CVE-2025-62518, a high-severity remote code execution vulnerability in the abandoned async-tar library for the Rust programming language. This logic flaw, named "TARmageddon," was unwittingly propagated to millions of users through downstream forks like tokio-tar and widely used build tools such as uv and testcontainers. The systemic risk arises because the vulnerability was replicated across a deep lineage of forks, making it very difficult to detect and patch comprehensively. Exploitation allows attackers to achieve remote code execution by overwriting files via malicious tar archives—a threat amplified by the lack of direct visibility into indirect dependencies in modern supply chains. The incident is especially impactful as it highlights the persistent risks of open-source abandonware and insufficient maintenance of foundational software libraries. It underscores growing industry focus on supply-chain security, indirect dependency management, and the need for rapid, coordinated vulnerability disclosure and remediation.
8 months ago
Kill Chain
Stealit Malware Abuses Node.js SEA in 2025 Infostealer Supply Chain Campaign
In October 2025, cybersecurity experts uncovered an active malware campaign involving Stealit, an advanced infostealer that exploits Node.js' Single Executable Application (SEA) feature to deliver its malicious payloads. The campaign also utilized the Electron framework and disguised its distribution through popular but trojanized game and VPN installers. Once executed, Stealit exfiltrated sensitive data from victims—such as credentials, browser information, and cryptocurrency wallets—using stealthy techniques while evading detection. The attack led to significant risks of account compromise and potential financial loss, particularly for organizations relying on affected software supply chains. This incident highlights a broader trend of attackers weaponizing modern development frameworks (like Node.js and Electron) to bypass traditional endpoint defenses. The use of legitimate-looking installers and supply chain manipulation signal an evolution in infostealer delivery tactics, making vigilance and advanced network segmentation crucial for organizational resilience.
8 months ago
Kill Chain
Astaroth Banking Trojan Leverages GitHub to Evade Takedowns in 2025
In October 2025, cybersecurity researchers uncovered a sophisticated campaign distributing the Astaroth banking trojan, which leveraged GitHub repositories as its primary command-and-control infrastructure. By shifting away from traditional, easily dismantled C2 servers, attackers used public code-hosting platforms to deploy configuration files and payloads. Targeted endpoints were infected through phishing campaigns, after which Astaroth would harvest credentials and financial data undetected. The integration with GitHub provided attackers increased operational resilience, making takedown efforts by defenders and law enforcement more challenging. Financial institutions and users experienced notable disruptions and heightened risk of unauthorized account activity due to these stealthy techniques. This incident highlights a growing trend of threat actors abusing legitimate platforms for illicit operations, undermining trust in cloud services. Organizations must reassess controls and detection strategies as adversaries increasingly exploit mainstream tools and shift to fileless, cloud-hosted malware models.
8 months ago
Kill Chain
How Malicious Open Source Packages Used Discord to Breach Developer Supply Chains in 2025
In October 2025, security researchers uncovered a widespread supply chain attack targeting popular open source repositories—including npm, PyPI, and RubyGems. Malicious packages were uploaded to these ecosystems and leveraged Discord webhooks as a covert command-and-control (C2) channel to exfiltrate sensitive developer data upon installation. The attackers took advantage of the ease of publishing code to open source registries, embedding scripts that silently siphoned credentials, environment variables, and other project secrets. Dozens of projects and potentially thousands of developers or organizations were impacted, risking further compromise via credential leakage and downstream dependency poisoning. This incident underscores the urgency of enforcing robust dependency hygiene and highlights a rising trend: attackers increasingly abusing trusted supply chains and common collaboration tools for exfiltration. As open source usage soars and supply chain security intensifies, organizations must be vigilant against covert exfiltration methods and adopt multilayered security controls.
8 months ago
Kill Chain
AMD RMPocalypse: 2025 SEV-SNP Hardware Flaw Shakes Confidential Computing
In October 2025, researchers from ETH Zürich disclosed a critical vulnerability, dubbed RMPocalypse, affecting AMD's Secure Encrypted Virtualization with Secure Nested Paging (SEV-SNP) technology. The flaw allowed attackers to undermine confidential computing protections by exploiting incomplete memory protections, making it feasible to alter a single 8-byte memory location and bypass hardware security boundaries. This discovery prompted AMD to release urgent patches across impacted EPYC server platforms, as the risk permitted threat actors—potentially including malicious tenants or insiders in cloud environments—to access sensitive workload data previously thought to be isolated and encrypted. This incident highlights persistent risks within hardware-assisted security frameworks and confidential computing platforms, as attackers increasingly target trusted execution environments. With a rise in high-confidence threats and supply-chain attacks, this breach sets a new precedent for cross-layer vulnerability research and the urgency of continuous hardware and firmware security validation.
8 months ago
Kill Chain
Critical SAP NetWeaver Zero-Day in 2025 Enables Unauthenticated Server Takeover
In October 2025, SAP disclosed and patched a critical zero-day vulnerability (CVE-2025-42944) in its NetWeaver Application Server Java platform, stemming from insecure deserialization. The vulnerability, rated CVSS 10.0, enabled unauthenticated remote attackers to execute arbitrary commands on affected servers, potentially compromising entire SAP landscapes. Though SAP issued urgent patches addressing 13 issues, the deserialization flaw was particularly notable for its potential to allow complete server takeover without credential access. Organizations were urged to deploy security updates immediately to prevent exploitation. This incident highlights the ongoing risk posed by deserialization vulnerabilities in widely deployed enterprise applications. As attackers accelerate exploitation of newly disclosed flaws, organizations must prioritize rapid patching, bolster application-layer controls, and monitor for lateral movement to mitigate the risk of business-critical system breaches.
8 months ago
Kill Chain
VS Code Extension Access Token Leak: A 2025 Supply Chain Wake-Up Call
In October 2025, a major supply chain risk was exposed when over 100 Visual Studio Code (VS Code) extensions were found to have leaked access tokens, allowing threat actors to publish malicious updates to widely used extensions. Attackers who obtained these tokens could have distributed compromised software versions to millions of developers globally, undermining trust in open-source ecosystems and introducing the risk of code tampering, credential theft, or insertion of backdoors into organizational environments. The vulnerability lay in the mishandling and inadvertent leakage of personal access tokens (PATs) for both the VSCode Marketplace and Open VSX, giving adversaries an insidious update path into developer workstations and CI/CD pipelines. This incident highlights the increasing frequency and sophistication of supply chain attacks targeting developer tools and open-source dependencies. As the software landscape grows more interconnected, private access tokens and code-signing credentials now represent high-value targets, requiring robust security controls and zero trust validation across the development lifecycle.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports