Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Computer Software/Engineering

Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.

2541 threat reports
Page 175 of 212
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Computer Software/Engineering Threat Reports

Showing 2089–2100 / 2541 reports
Rogue NuGet Impersonates Tracer.Fody, Orchestrates Multi-Year Crypto Wallet Theft
Computer Software/Engineering10 months ago

Rogue NuGet Impersonates Tracer.Fody, Orchestrates Multi-Year Crypto Wallet Theft

Between February 2020 and December 2025, a malicious NuGet package named "Tracer.Fody.NLog" posed as the legitimate .NET tracing library, Tracer.Fody, and was covertly distributed via typosquatting and mimicking developer identities. The package, uploaded by a threat actor under the handle "csnemess," evaded detection for almost six years, collecting over 2,000 downloads. Instead of offering legitimate functionality, this package deployed a wallet stealer: scanning the default Stratis wallet directory on Windows systems, exfiltrating wallet data and passwords to threat actor infrastructure hosted in Russia, with attackers leveraging crafted code and hidden routines to bypass superficial code reviews. The prolonged success of this attack underscores the persistent risk supply chain threats pose to open-source ecosystems, especially for developer tools and libraries. It highlights attackers’ sophistication in mimicking trusted maintainers, the difficulty of detecting such manipulation, and ongoing regulatory and security pressures to improve package repository hygiene and detection.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Parked Domains Weaponized: Inside the 2025 Typosquatting Malvertising Surge
Banking/Mortgage10 months ago

Parked Domains Weaponized: Inside the 2025 Typosquatting Malvertising Surge

In late 2025, security researchers uncovered that over 90% of parked domains—unused, expired, or misspelled web addresses—were actively redirecting visitors to malicious destinations, including scams, malware, and deceptive subscription offers. Utilizing techniques like device fingerprinting, IP geolocation, and chained redirects, threat actors profited by manipulating the domain parking ecosystem, turning innocuous navigation mistakes into vectors for malware delivery and fraud. The campaign targeted high-profile brands and government offices, often bypassing detection by profiling user access (e.g., residential IPs or VPN use), with some domains weaponized for business email compromise. This incident highlights an alarming shift: parked and typo domains are now a primary malvertising risk, not a minor threat. As domain registration and ad platform policies evolve, attackers rapidly adapt, exploiting weaknesses in digital trust and endpoint security. Organizations must broaden threat detection and policy enforcement to address direct navigation attacks and affiliate-driven malvertising.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
8 Million Users' AI Conversations Exposed: Urban VPN Browser Extension's Hidden Data Harvest
Computer Software/Engineering10 months ago

8 Million Users' AI Conversations Exposed: Urban VPN Browser Extension's Hidden Data Harvest

In December 2025, security researchers exposed that the popular Urban VPN Proxy browser extension—marketed for privacy—was actively harvesting and exfiltrating sensitive conversation data from over eight million users interacting with leading AI chatbot platforms such as ChatGPT, Claude, Gemini, and Copilot. The malicious behavior was introduced in versions released after July 2025, with the extension injecting scripts into browser sessions to intercept, package, and transmit users’ chatbot prompts, responses, and session metadata to servers operated by Urban VPN’s parent, BiScience, a known data broker. Users were not offered any meaningful way to disable this data collection besides uninstalling the extension, and the privacy disclosure was deeply buried within the setup process, leaving the majority unaware. This incident underscores the growing risk posed by privacy-violating browser extensions, especially those with elevated reputations and millions of installations. As AI assistants become repositories for sensitive personal and corporate data, the implications of such data leaks—from regulatory compliance to business confidentiality—are amplified, driving urgent reassessment of browser extension governance and AI data security controls.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Opexus 2024 Insider Breach: Lax Vetting Enables Sensitive Federal Data Theft
Government Administration10 months ago

Opexus 2024 Insider Breach: Lax Vetting Enables Sensitive Federal Data Theft

In February 2024, Opexus, a federal IT services provider, suffered a significant internal data breach at the hands of recently terminated employees, Muneeb and Sohaib Akhter. Despite passing standard background checks, the Akhter twins—who had prior convictions for cybercrimes—were able to exploit their insider access minutes after being fired, deleting and exfiltrating sensitive data from U.S. government agencies, including DHS, IRS, and EEOC. Key company missteps included inadequate offboarding controls, missed red flags in hiring, and delayed user account revocation, compounding the impact on critical federal data and operations. This breach underscores rising risks linked to insider threats, especially among trusted staff with privileged access. Failures in vetting, change management, and technical safeguards contributed to the severity and highlight the urgent need for robust zero trust, continuous monitoring, and improved personnel screening, particularly for organizations entrusted with sensitive public sector data.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Apple Patches 2025 WebKit Zero-Day Exploits Used in Sophisticated Spyware Attacks
Computer Software/Engineering10 months ago

Apple Patches 2025 WebKit Zero-Day Exploits Used in Sophisticated Spyware Attacks

In December 2025, Apple urgently released patches for two zero-day vulnerabilities in its WebKit browser engine—CVE-2025-43529 and CVE-2025-14174—after reports of their exploitation in highly sophisticated attacks targeting specific individuals. Discovered in collaboration with Google's Threat Analysis Group, these vulnerabilities enabled potential arbitrary code execution via malicious web content due to use-after-free and memory corruption flaws. The vulnerabilities overlapped with a mysterious zero-day Google patched in Chrome, underlining the risk of cross-platform exposure via shared components. Affected devices included iOS, iPadOS, and macOS, with rapid patch distribution through emergency security advisories. This incident spotlights a growing trend of highly targeted, advanced exploitation chains, frequently leveraging zero-day flaws used in commercial spyware and state-level operations. It underscores the increasing urgency for organizations and individuals to maintain aggressive patch hygiene and layered endpoint defenses as anonymous, sophisticated exploitations proliferate.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
SantaStealer: The 2024 Memory-Based Infostealer Malware Targeting Credentials and Crypto Wallets
Financial Services10 months ago

SantaStealer: The 2024 Memory-Based Infostealer Malware Targeting Credentials and Crypto Wallets

In early 2024, a new information-stealing malware known as SantaStealer emerged on cybercriminal Telegram channels and hacker forums, operating as a malware-as-a-service (MaaS). Designed to run primarily in memory, SantaStealer avoids traditional file-based detection and targets sensitive data in browsers, cryptocurrency wallets, and installed application credentials. Attackers typically distribute the malware through phishing campaigns and malicious attachments. Once executed, SantaStealer exfiltrates stolen data to command-and-control servers, enabling threat actors to harvest victims' digital assets and credentials for further exploitation or sale on underground markets. The incident underlines a growing trend of evasive, memory-resident stealer malware leveraging MaaS models. Cybercriminals are accelerating adoption of these techniques, raising the stakes for organizations and individuals who store credentials and assets on personal and enterprise endpoints.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Critical Apple 0-Days and WinRAR Exploits: How Multi-Vector Threats Changed 2025
Computer Software/Engineering10 months ago

Critical Apple 0-Days and WinRAR Exploits: How Multi-Vector Threats Changed 2025

In December 2025, a wave of critical zero-day vulnerabilities targeting Apple devices, WinRAR, OAuth implementations, and the .NET framework was actively exploited by various cybercriminal groups. Attackers leveraged these flaws to bypass authentication mechanisms, execute remote code, and escalate privileges across both consumer and enterprise environments. Notably, some exploits were weaponized in the wild before official patches became available, resulting in widespread exposure of unencrypted traffic, unauthorized access to internal networks, and large-scale credential theft. Organizations experienced data breaches, ransomware infections, and regulatory scrutiny, particularly where weak segmentation or inadequate traffic visibility allowed lateral movement. This incident highlights the persistent threat posed by simultaneous multi-vector exploits, especially as attackers rapidly adopt new vulnerabilities in mainstream software. Increased regulatory focus on immediate patching and advanced segmentation underscores the necessity for robust, real-time threat detection and zero trust enforcement across hybrid and multi-cloud ecosystems.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
ShadyPanda’s Browser Extension Supply-Chain Attack Exposes Millions in 2025
Computer Software/Engineering10 months ago

ShadyPanda’s Browser Extension Supply-Chain Attack Exposes Millions in 2025

In December 2025, security researchers uncovered a widespread supply-chain attack perpetrated by the threat group ShadyPanda, which had silently compromised several popular Chrome and Edge browser extensions. Over the course of seven years, ShadyPanda either published or acquired seemingly innocuous extensions, allowed them to build credibility and large user bases, and then weaponized them through malicious updates. The attackers exploited the implicit trust in browser extension ecosystems to exfiltrate user data and potentially inject hostile code into millions of browsers worldwide, impacting individuals and organizations alike. This incident underscores persistent risks in software supply chains, as threat actors increasingly target trusted application ecosystems to achieve broad access. As browser extensions remain integral to productivity and daily workflows, the event highlights the urgency for organizations to monitor third-party components and reassess extension management, especially amid evolving regulatory scrutiny and attacker sophistication.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Urban VPN Chrome Extension Found Harvesting AI Chat Prompts from Millions
Computer Software/Engineering10 months ago

Urban VPN Chrome Extension Found Harvesting AI Chat Prompts from Millions

In late 2025, the "Urban VPN Proxy" Chrome extension—prominently labeled 'Featured' in the Chrome Web Store and boasting over six million users—was discovered silently harvesting all prompts users entered into popular AI chatbots such as ChatGPT, Anthropic Claude, Microsoft Copilot, Google Gemini, and others. Security researchers found the extension covertly intercepted and exfiltrated sensitive data in real time, leveraging its widespread user base and the inherent trust of its browser privileges. The extension’s activity amounted to a massive privacy breach, putting both individuals and enterprises at risk of data exposure. This breach highlights a surge in supply chain and third-party risks posed by browser extensions in the modern SaaS ecosystem. Enterprise security teams face heightened challenges as unregulated extensions become vectors for data harvesting, especially as reliance on AI tools increases. Privacy expectations, compliance obligations, and trust in official app marketplaces are now under renewed scrutiny.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
React2Shell CVE-2025-55182: Remote Code Execution Attacks Surge in 2025
Computer Software/Engineering10 months ago

React2Shell CVE-2025-55182: Remote Code Execution Attacks Surge in 2025

In December 2025, active exploitation of a critical vulnerability in React2Shell (CVE-2025-55182) was detected, enabling remote code execution on unpatched servers. Attackers deployed a sequence of crafted HTTP requests to download and write malicious binaries onto world-writable Linux directories, such as /dev/shm and /tmp, then modified permissions to prepare for subsequent execution. The threat was identified by security researchers monitoring exploit payloads, which often leveraged ambiguous malware—classified as either adware or crypto miners—resulting in the compromise of affected servers and potentially unauthorized resource usage or data exfiltration. This campaign exemplifies the ongoing risk posed by delayed patch management, with adversaries swiftly evolving their payloads and exploiting widespread attack surfaces. The frequency of similar incidents underscores the importance of timely security updates and hardened configurations, particularly for widely deployed web services.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(medium)
Read report
Critical React & Next.js Deserialization Bug Leads to RCE: What You Need to Know
Computer Software/Engineering10 months ago

Critical React & Next.js Deserialization Bug Leads to RCE: What You Need to Know

In April 2025, security researchers disclosed critical vulnerabilities (CVE-2025-55182 and CVE-2025-66478) affecting the React and Next.js frameworks, specifically tied to unsafe data serialization and deserialization mechanisms in the Server Actions and Flight protocol. Attackers exploited the flaw to achieve remote code execution (RCE), enabling credential harvesting, lateral movement, and persistent access across affected environments. Within days of the CVEs’ disclosures, weaponized public exploit scripts proliferated on GitHub, compressing defenders’ reaction times and raising the risk of widespread attacks on applications running modern web stacks. This incident highlights the persistent danger of insecure serialization across software ecosystems, a threat pattern seen across at least a decade and multiple development languages. As AI-augmented coding accelerates release cycles, the lessons of past serialization flaws remain vital to protect emerging cloud-native applications from rapidly evolving threats.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
MITRE 2025: The Top 25 Most Dangerous Software Weaknesses Revealed
Computer Software/Engineering10 months ago

MITRE 2025: The Top 25 Most Dangerous Software Weaknesses Revealed

In June 2025, MITRE released its annually curated list of the Top 25 Most Dangerous Software Weaknesses, compiling exploit data from 39,000 security vulnerabilities reported between June 2024 and June 2025. This report is used globally by software vendors, security teams, and regulators to target systemic issues—such as improper input validation, use-after-free errors, and insufficient authentication—that are consistently abused by cybercriminals and advanced threat actors. The publication aims to increase awareness and prioritize remediation actions, reducing exposure to the most common and severe attack vectors across both enterprise and critical infrastructure sectors. MITRE's 2025 CWE Top 25 is particularly relevant as organizations respond to a continuing rise in supply chain attacks and software-targeted ransomware campaigns. Regulatory frameworks increasingly demand proactive vulnerability management and prioritization based on real-world exploitability—making this list a critical resource for compliance, risk reduction, and secure software development initiatives.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports