Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Computer Software/Engineering

Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.

2541 threat reports
Page 189 of 212
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Computer Software/Engineering Threat Reports

Showing 2257–2268 / 2541 reports
Malicious npm Typosquatting Campaign Targets GitHub Supply Chain — 2025 Incident Report
Computer Software/Engineering10 months ago

Malicious npm Typosquatting Campaign Targets GitHub Supply Chain — 2025 Incident Report

In October 2025, cybersecurity researchers detected a supply chain attack involving a malicious npm package named "@acitons/artifact," designed to typosquat the popular GitHub-associated package "@actions/artifact." The attacker attempted to infiltrate GitHub-owned repositories by enticing developers to inadvertently include the rogue package in their build pipelines. Once installed, the malicious code sought to exfiltrate sensitive build environment tokens, which could be exploited to gain unauthorized access to publish or modify code repositories, potentially impacting the integrity and security of widely used open-source projects. This incident highlights a broader trend in threat actor tactics leveraging typosquatting and supply chain vectors to compromise trusted development environments. With the rapid increase in CI/CD automation and open-source dependencies, organizations across industries face mounting risk from similar attacks targeting software supply chains.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
CISO Playbook: Responding to the 2025 AI Supply Chain Attack Crisis
Computer Software/Engineering10 months ago

CISO Playbook: Responding to the 2025 AI Supply Chain Attack Crisis

In 2025, the global software development and technology sector faced one of the most disruptive AI-enabled supply chain attacks to date. Threat actors leveraged machine learning to automate the insertion and propagation of malicious packages into widely used open-source repositories, targeting dependencies incorporated by thousands of enterprises worldwide. The initial breach was undetected due to sophisticated code obfuscation and AI-driven capability to mimic legitimate update patterns. As organizations unwittingly integrated these compromised modules, attackers gained unauthorized access, facilitated credential theft, and enabled lateral movement within victim environments, ultimately impacting business operations and exposing sensitive data. This incident underscores the escalating threat posed by AI-assisted supply chain attacks, where attackers rapidly iterate and deploy tactics outpacing traditional detection measures. The significant surge in malicious package uploads, sophisticated polymorphic payloads, and targeted exploitation of widely trusted repositories reveal an urgent need for CISOs to reassess their supply chain defense strategies, especially as regulatory scrutiny around software provenance intensifies worldwide.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
GootLoader’s 2025 Comeback: Font Evasion Drives WordPress Malware Surge
Computer Software/Engineering10 months ago

GootLoader’s 2025 Comeback: Font Evasion Drives WordPress Malware Surge

In late October 2025, security firm Huntress detected a resurgence of the GootLoader malware, targeting WordPress sites by leveraging a novel font obfuscation technique to deliver malicious payloads. Over the course of several days, analysts observed three distinct GootLoader infections, two of which escalated to hands-on-keyboard intrusions, resulting in full domain controller compromises within 17 hours of initial exposure. Attackers exploited legitimate but vulnerable WordPress sites to lure victims, facilitating subsequent lateral movement once inside organizational networks, and maximizing their potential impact on business operations. GootLoader's resurgence, paired with new evasion techniques, exemplifies the ongoing arms race between threat actors and defenders. Security teams must maintain heightened vigilance amid renewed focus on web-based attack vectors and advanced malware loaders that can escalate quickly to business-critical breaches.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
GlassWorm Supply Chain Attack Exposes VS Code and Developer Ecosystems
Computer Software/Engineering10 months ago

GlassWorm Supply Chain Attack Exposes VS Code and Developer Ecosystems

In June 2024, a coordinated supply chain attack involving the GlassWorm malware targeted the Open VSX marketplace, enabling the spread of compromised Visual Studio Code extensions. Attackers weaponized these extensions to propagate malware onto developer devices globally, facilitating lateral movement and potential data exfiltration within development environments. Threat actors leveraged the trust inherent in popular code repositories to deploy self-propagating malware, which remained undetected for weeks, impacting thousands of developers and exposing software supply chains to significant risk. This incident underscores the vulnerabilities presented by reliance on third-party developer tools and the sophisticated nature of modern supply-chain threats. The GlassWorm incident highlights a growing trend where attackers exploit software development ecosystems to gain broad access to sensitive environments. As reliance on open source and marketplace extensions increases, organizations must strengthen their posture against these evolving supply-chain vulnerabilities and ensure detection capabilities span both inbound and internal (east-west) traffic.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Expr-eval JavaScript Library Faces Supply-Chain RCE Vulnerability in 2024
Computer Software/Engineering10 months ago

Expr-eval JavaScript Library Faces Supply-Chain RCE Vulnerability in 2024

In March 2024, a critical remote code execution (RCE) vulnerability was identified in expr-eval, a widely used JavaScript mathematical expression evaluator with over 800,000 weekly NPM downloads. The flaw, if exploited through maliciously crafted input, allowed attackers to execute arbitrary code within applications leveraging the vulnerable versions of the library. As expr-eval is integrated into numerous projects and frameworks, the supply-chain impact was significant, exposing countless downstream applications to the risk of compromise and highlighting the cascading dangers of third-party dependency vulnerabilities. This incident underscores the increasing focus by attackers on widely adopted open-source libraries as high-leverage supply-chain targets. The expr-eval vulnerability echoes a broader industry trend where modern development practices introduce risks outside direct organizational control, prompting renewed concerns about dependency management, zero trust for software supply chains, and regulatory calls for heightened software bill of materials (SBOM) transparency.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
GlassWorm: Malicious VS Code Extensions Trigger a New Wave of Supply-Chain Attacks
Computer Software/Engineering10 months ago

GlassWorm: Malicious VS Code Extensions Trigger a New Wave of Supply-Chain Attacks

In late 2025, cybersecurity researchers discovered the 'GlassWorm' malware campaign actively targeting the Visual Studio Code (VS Code) ecosystem via three malicious extensions available on the official marketplace. With over 7,400 combined downloads, these extensions enabled threat actors to inject malware directly into developers' environments, facilitating credential theft, remote access, and potential downstream supply-chain attacks. Attackers leveraged trusted community tools as the entry vector, bypassing traditional perimeter defenses to gain a foothold in development workflows and potentially propagate malware throughout interconnected repositories. This incident underscores the rising prevalence of supply-chain attacks in the software development ecosystem and the unique risks posed by compromised IDE extensions. The popularity of VS Code amplifies the potential blast radius, highlighting an urgent need for improved extension vetting, granular access controls, and continuous threat monitoring within CI/CD pipelines.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Konni APT Exploits Google’s Find Hub to Launch Data-Wiping Attacks
Government Administration10 months ago

Konni APT Exploits Google’s Find Hub to Launch Data-Wiping Attacks

In late 2025, the North Korea-linked threat actor known as Konni (also referred to as Earth Imp, Opal Sleet, TA406, and Vedalia) launched a sophisticated campaign targeting Android and Windows users by abusing Google’s Find Hub functionality as a remote data-wiping weapon. The attackers impersonated psychological counselors and North Korean human rights activists, distributing malware via fake stress-relief applications that enabled remote access, data theft, and destructive wipes. The operation leveraged advanced evasion tactics, encrypted traffic channels, and targeted high-value individuals, resulting in significant loss and compromise of sensitive personal and organizational information. This incident exemplifies the growing risk from state-affiliated actors using social engineering and legitimate platform abuse to bypass defenses. With threat techniques evolving, organizations must now prioritize threat hunting, advance east-west traffic visibility, and enforce robust segmentation policies to catch and contain similar attacks.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
TEE.fail: 2025 Hardware Attack Cracks Latest Secure Enclaves
Computer Software/Engineering10 months ago

TEE.fail: 2025 Hardware Attack Cracks Latest Secure Enclaves

In November 2025, researchers disclosed a critical hardware attack known as TEE.fail, which compromised secure enclaves (trusted execution environments or TEEs) across Intel, AMD, and ARM chips. By placing a small hardware device between a DDR5 memory chip and the motherboard, and leveraging kernel-level privileges, attackers were able to bypass the most advanced TEE protections including Confidential Compute, SEV-SNP, and TDX/SDX. Once exploited, these secure enclaves could no longer be trusted to protect sensitive data in-use, raising major concerns for cloud providers, enterprises, and users reliant on confidential computing. The attack’s low cost, simplicity, and applicability to modern hardware make it a significant development, reflecting growing sophistication in hardware-level threats. Regulatory scrutiny and industry attention have intensified as organizations reevaluate their trust assumptions and risk models for sensitive workloads.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
runC Vulnerabilities Threaten Container Security: Docker and Kubernetes Breach 2024
Information Technology/IT10 months ago

runC Vulnerabilities Threaten Container Security: Docker and Kubernetes Breach 2024

In June 2024, critical vulnerabilities (CVE-2024-21626, CVE-2024-21627, and CVE-2024-21628) were disclosed in the runC container runtime, which underpins Docker, Kubernetes, and many modern container platforms. These flaws could be exploited by attackers to break out of a container, bypassing isolation controls and gaining unauthorized access to the underlying host system. A successful exploit would allow lateral movement and potentially compromise entire cloud or on-premises environments. Prompt patching and risk assessment are essential, as proof-of-concept exploits have already been published in the wild. This incident underscores the increasing sophistication and focus of attackers on supply chain and containerization technologies, as organizations accelerate cloud and DevOps adoption. As regulatory expectations around zero trust and runtime controls intensify, keeping pace with container threat vectors is now mission-critical for enterprise security teams.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
GlassWorm Supply Chain Attack: Malicious VSCode Extensions Threaten Open Source Ecosystem
Computer Software/Engineering10 months ago

GlassWorm Supply Chain Attack: Malicious VSCode Extensions Threaten Open Source Ecosystem

In June 2024, the GlassWorm malware resurfaced in a significant supply chain attack on the OpenVSX and Visual Studio Code (VSCode) extension marketplaces. Threat actors uploaded three malicious extensions, which were collectively downloaded over 10,000 times before detection and removal. These extensions were designed to compromise developer environments by deploying malware capable of exfiltrating credentials and enabling persistent access. The attack leveraged trusted open-source ecosystems, making it difficult for end users and organizations to detect the compromise until indicators of compromise (IoCs) were published, potentially exposing sensitive data and intellectual property. This event underscores a broader rise in supply chain attacks targeting developer tools and open-source package ecosystems. The campaign highlights the urgent need for rigorous code vetting, extension auditing, and enhanced supply chain security controls as attackers increasingly exploit automated trust in widely used development platforms.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Microsoft's 'Whisper Leak' Side-Channel Attack Bypasses Encryption for AI Traffic
Financial Services10 months ago

Microsoft's 'Whisper Leak' Side-Channel Attack Bypasses Encryption for AI Traffic

In late 2025, Microsoft researchers uncovered the 'Whisper Leak' side-channel attack, a novel method allowing passive adversaries to deduce the topics of conversations with streaming AI language models despite the use of encrypted, high-performance network protocols. Attackers exploited traffic analysis techniques, observing packet timing and size patterns, to infer sensitive discussion details traversing enterprise VPNs and encrypted links. Although private circuit encryption such as MACsec and IPsec was in place, the attack effectively bypassed traditional data-in-transit security controls, raising concerns for sectors leveraging AI in sensitive communications. This incident is significant as it highlights an emerging risk where encrypted cloud AI traffic can be compromised via sophisticated traffic analysis, just as generative AI adoption is surging across regulated industries. It illustrates evolving attacker sophistication beyond classical exploits, prompting urgent review of AI data security and zero trust segmentation strategies.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
'Ransomvibing' Supply Chain Attack Strikes Visual Studio Extension Marketplace
Computer Software/Engineering10 months ago

'Ransomvibing' Supply Chain Attack Strikes Visual Studio Extension Marketplace

In early 2024, a malicious Visual Studio Code extension named 'Ransomvibing' was discovered on the Visual Studio Marketplace. The extension used AI-generated code to encrypt and exfiltrate sensitive project data from developer environments, leveraging encrypted outbound traffic to evade traditional detection methods. Despite containing telltale signs of automation and suspicious behavior, the extension bypassed security controls and was downloaded before being taken down, exposing users to significant intellectual property and operational risks associated with a compromised development supply chain. This incident highlights growing risks in open-source and extension marketplaces, as attackers increasingly exploit trusted software ecosystems with novel supply-chain techniques. Organizations should prioritize continuous monitoring of third-party integrations and reinforce their zero trust controls in response to evolving adversary methods.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports