The breach isn’t the problem. The spread is. →Free Assessment

aviatrix logoAviatrix
Under Active Attack
Industry Category

Computer Software/Engineering

Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.

2488 threat reports
Page 205 of 208
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Computer Software/Engineering Threat Reports

Showing 2449–2460 / 2488 reports
Apple’s 2025 Zero-Day Puts iOS & macOS Security in Spotlight: What You Need to Know
Computer Software/Engineering9 months ago

Apple’s 2025 Zero-Day Puts iOS & macOS Security in Spotlight: What You Need to Know

In September 2025, Apple issued urgent patches for iOS, iPadOS, and macOS in response to several critical vulnerabilities, with CVE-2025-43300 standing out due to active exploitation in sophisticated targeted attacks. The vulnerability, affecting the ImageIO component, enabled attackers to compromise devices by processing malicious image files, potentially resulting in memory corruption and enabling unauthorized access or control. Previous patches were limited to the latest OS versions, leaving older systems exposed until this coordinated rollout addressed those gaps. Apple further backported fixes to supported older releases to mitigate the heightened risk of exploitation. This incident underscores an accelerating wave of zero-day vulnerabilities leveraged in real-world attacks, highlighting the persistent threats facing major software ecosystems like Apple’s. The discovery and rapid backporting response reflects mounting regulatory and industry pressure to quickly secure even legacy platforms and close compliance gaps.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
npm’s Largest Supply Chain Compromise: Phishing and the Fragility of Open Source Security
Computer Software/Engineering9 months ago

npm’s Largest Supply Chain Compromise: Phishing and the Fragility of Open Source Security

In June 2024, a major npm supply chain compromise saw attackers inject malicious code into 18 highly popular JavaScript packages, including chalk and debug, which together accounted for over 2.6 billion weekly downloads. The breach began with a successful phishing attack targeting a package maintainer, resulting in the theft of two-factor authentication credentials. Threat actors quickly published backdoored versions of affected packages, which were downloaded millions of times in minutes before rapid detection and disclosure limited the fallout. The immediate financial losses were low, with only minimal amounts of cryptocurrency stolen, but the operational impact included widespread remediation efforts across thousands of organizations dependent on these open-source assets. This incident exemplifies the growing risk and frequency of supply chain attacks leveraging compromised maintainers and rapid malware propagation in software registries. It highlights the urgent need for enhanced account security, ecosystem-level safeguards, and improved transparency, as such compromises are increasingly targeted by sophisticated actors and threaten the core trust mechanisms of modern digital infrastructure.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Phoenix Attack Bypasses DDR5 Rowhammer Defenses in 2025
Financial Services9 months ago

Phoenix Attack Bypasses DDR5 Rowhammer Defenses in 2025

In September 2025, researchers from ETH Zurich and Google disclosed the 'Phoenix' attack—a novel Rowhammer-based hardware vulnerability that successfully bypasses the Target Row Refresh (TRR) defenses in popular DDR5 memory chips, specifically targeting modules from market leader SK Hynix. By exploiting specific shortcomings in TRR’s sampling intervals and synchronizing access over precise refresh cycles, the Phoenix attack can reliably induce bit flips in physical memory. In controlled tests, the attack enabled researchers to gain root-level privileges on commodity systems in under two minutes, expose sensitive cryptographic keys across virtual machines, and manipulate binaries such as sudo for rapid local privilege escalation. The vulnerability, now tracked as CVE-2025-6202, impacts DDR5 modules manufactured between January 2021 and December 2024, posing industry-wide risk since current mitigations are ineffective for existing hardware. This incident stands out as it revives concerns over hardware-level attacks that are resistant to conventional software security solutions. As threats like Phoenix emerge, it highlights the rapid evolution of side-channel and privilege-escalation techniques even in the face of new hardware protections, underlining the pressing need for industry collaboration and innovation on memory security standards.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Malicious MCP Servers: How AI Supply Chain Integrations Were Weaponized in 2024
Computer Software/Engineering9 months ago

Malicious MCP Servers: How AI Supply Chain Integrations Were Weaponized in 2024

In early 2024, security researchers uncovered a novel supply chain attack exploiting the Model Context Protocol (MCP), an emerging integration layer for AI assistants. Attackers published seemingly legitimate MCP servers on public repositories such as PyPI, which, once installed by developers, silently harvested sensitive credentials, SSH keys, cloud configs, and API secrets. Data exfiltration was cleverly disguised as benign HTTP requests to plausible endpoints, while the malicious packages mimicked real productivity tools, evading both user scrutiny and common detection mechanisms. This attack leveraged implicit trust in third-party AI extensions, exposing a major blind spot for organizations integrating AI into development workflows. This breach reflects a growing trend where adversaries weaponize trusted AI integration points, mirroring techniques seen in Open Source and DevOps supply chain compromises. As enterprise AI adoption accelerates, similar threats targeting protocol-level integration, plugin ecosystems, and shadow AI deployments are expected to rise, intensifying regulatory and governance pressures around software supply chain security.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Salesloft GitHub Compromise: How a 2025 Supply-Chain Attack Rippled Across 22 Companies
Computer Software/Engineering9 months ago

Salesloft GitHub Compromise: How a 2025 Supply-Chain Attack Rippled Across 22 Companies

In mid-2025, Salesloft disclosed a significant data breach stemming from a compromise of its GitHub account linked to its Drift application. The incident was investigated by Mandiant, which attributed the activity to the threat actor group UNC6395. Attackers maintained unauthorized access from March through June 2025, enabling them to pivot laterally and potentially compromise sensitive code, data, and operational assets. The breach's supply-chain nature led to downstream impacts, reportedly affecting at least 22 distinct organizations that relied on the compromised software or APIs. This breach highlights the persistent risk posed by supply-chain compromises and stolen developer credentials within cloud ecosystems. With threat actors increasingly targeting development tools and identity-driven pipelines, organizations face mounting regulatory and operational urgency to remediate authentication weaknesses and enforce segmenting policies across their CI/CD toolchains.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(medium)
Read report
Inside the 2025 Salesloft Drift SaaS Supply Chain Breach: Lessons in Token Management
Computer Software/Engineering9 months ago

Inside the 2025 Salesloft Drift SaaS Supply Chain Breach: Lessons in Token Management

In early 2025, a significant supply chain breach occurred when threat actor UNC6395 exploited a dormant OAuth token from a third-party Salesloft Drift integration within a Salesforce environment. Leveraging the compromised token—which bypassed MFA—the attacker launched automated connections from multiple unknown VPNs, enumerating CRM accounts and exfiltrating customer data, including embedded credentials. This enabled lateral movement, granting persistent, unauthorized access to hundreds of downstream client Salesforce instances and facilitating privilege escalation into additional systems via harvested secrets. The incident underscores an urgent trend of attackers exploiting inadequately governed third-party integrations, token sprawl, and absent monitoring. With growing SaaS adoption and rising API-driven architectures, identity-driven supply chain attacks have become top risks, accelerating regulatory scrutiny and industry demand for automated token hygiene, lifecycle management, and more rigorous third-party security postures.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Salesloft Drift OAuth Breach Compromises Salesforce: 2025 Supply Chain Attack Analysis
Computer Software/Engineering9 months ago

Salesloft Drift OAuth Breach Compromises Salesforce: 2025 Supply Chain Attack Analysis

In August 2025, a supply chain attack leveraging the Salesloft Drift integration was used to compromise customer Salesforce instances. Threat actors exploited compromised OAuth credentials between August 8-18, enabling them to perform automated, high-volume data exfiltration from sensitive Salesforce objects such as Account, Contact, Case, and Opportunity records. Following exfiltration, the attackers reportedly scanned acquired data for credentials and leveraged anti-forensic tactics, including deletion of query logs, to obscure their activities. Salesloft promptly revoked all relevant tokens and notified impacted customers, while security teams advised immediate credential rotations and log investigation for signs of compromise. This incident spotlights the risks associated with third-party SaaS integrations and highlights the sophistication of attackers targeting popular business platforms. As OAuth-based attacks and API exploitations become more common, organizations must enhance supply chain monitoring, review privilege access, and adopt zero trust principles to mitigate similar breaches.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
2025 Salesforce Supply Chain Breach Unveiled: UNC6040 and UNC6395’s Advanced OAuth Attacks
Computer Software/Engineering9 months ago

2025 Salesforce Supply Chain Breach Unveiled: UNC6040 and UNC6395’s Advanced OAuth Attacks

In mid-2025, cybercriminal threat clusters UNC6040 and UNC6395 launched coordinated attacks targeting the Salesforce environments of major global enterprises, leveraging supply chain compromises, OAuth token abuse, and social engineering tactics. Attackers tricked employees into authorizing malicious OAuth apps or exploited stolen access tokens, enabling mass data exfiltration from Salesforce—including sensitive 'Accounts', 'Contacts', and support case records containing credentials and cloud secrets. Stolen information was subsequently used by the ShinyHunters extortion group for ransom threats and further infiltrations, impacting organizations such as Google, Cisco, Adidas, and major cybersecurity firms. This incident exemplifies a growing wave of attacks exploiting trusted third-party platforms and identity federation weaknesses to compromise cloud SaaS data at scale. The sophisticated multi-stage approach highlights urgent risks related to SaaS supply chains, the need for robust OAuth governance, and increased vigilance toward privilege escalation via indirect access vectors.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
AsyncRAT Attackers Exploit ConnectWise ScreenConnect—Credential & Crypto Theft on the Rise
Computer Software/Engineering9 months ago

AsyncRAT Attackers Exploit ConnectWise ScreenConnect—Credential & Crypto Theft on the Rise

In September 2025, cybersecurity researchers identified a sophisticated attack leveraging the ConnectWise ScreenConnect remote monitoring tool to deliver AsyncRAT, a potent remote access trojan. Threat actors exploited legitimate RMM infrastructure to establish unauthorized access, bypass defenses, and deploy a VBScript-based loader on victim systems. Once installed, AsyncRAT facilitated unauthorized credential harvesting and cryptocurrency theft from compromised hosts, exposing sensitive business and personal data. The campaign’s use of trusted IT management software as an initial entry vector complicated detection and posed significant risks to organizations relying on remote administration tools. This incident underscores an increasing security challenge: the abuse of legitimate remote management solutions by attackers to evade detection and propagate malware. As identity-driven and tool-based attacks surge, businesses must re-examine their controls, segmentation, and monitoring to counter exploitation of sanctioned IT utilities.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(low)
Read report
Vyro AI 2024 GenAI Data Leak: Why Cyber Hygiene Can't Wait
Computer Software/Engineering9 months ago

Vyro AI 2024 GenAI Data Leak: Why Cyber Hygiene Can't Wait

In early 2024, Vyro AI experienced a significant data leak involving the unintentional exposure of proprietary and sensitive user data via a GenAI platform. The incident occurred when internal users, unaware of best security practices, shared confidential information with generative AI tools that did not have adequate encryption or access controls. This exposed private data to unauthorized individuals and third parties, highlighting deficiencies in the company’s data protection policies and cloud application oversight. This breach is emblematic of the growing risks associated with GenAI usage in enterprise environments, where shadow IT and user-driven data sharing can sidestep traditional security controls. As organizations adopt AI at scale, ensuring robust data governance and compliance is more critical than ever to avoid regulatory and reputational fallout.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
2025 Cursor AI Code Editor Vulnerability: Supply-Chain Risk via Malicious Repositories
Computer Software/Engineering9 months ago

2025 Cursor AI Code Editor Vulnerability: Supply-Chain Risk via Malicious Repositories

In September 2025, a security flaw was disclosed affecting Cursor, an AI-powered code editor, that allowed silent code execution when users opened repositories embedded with malicious payloads. The vulnerability stemmed from a default-disabled security setting, letting attackers execute arbitrary code on victim machines under their own user privileges. Security researchers highlighted the risk of potential supply-chain attacks, as any developer opening a tampered repository could unwittingly trigger the exploit, potentially leading to credential theft, system compromise, or further lateral movement within organizational networks. The impact was amplified by Cursor's AI-driven capabilities and its popularity in modern development environments. This incident spotlights the growing risks at the intersection of AI-driven tools and software supply chains. With more organizations relying on smart code editors and automated workflows, attackers are increasing their focus on weaknesses in tool defaults and developer behaviors, driving regulatory concern and heightening the urgency for robust code execution safeguards.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Cryptojacking Surge: TOR-Based Attack Exploits Docker API Misconfigurations in 2025
Information Technology/IT9 months ago

Cryptojacking Surge: TOR-Based Attack Exploits Docker API Misconfigurations in 2025

In July 2025, cybersecurity researchers identified a new wave of cryptojacking attacks leveraging the TOR network to hide command-and-control infrastructure. Attackers targeted internet-exposed and misconfigured Docker APIs, deploying malicious containers that mined cryptocurrency on compromised infrastructures. This campaign, tracked by Akamai and initially reported by Trend Micro in June 2025, showed sophisticated behaviors including blocking rival threat actors and securing persistence, which increased the impact on affected organizations by silently draining cloud computing resources and escalating operational costs. This incident highlights the growing convergence of container security risks and anonymizing networks like TOR, reflecting a broader trend of attackers shifting toward stealthy, infrastructure-focused exploits. With cloud-native workloads and container orchestration becoming standard, organizations face urgent regulatory and operational pressure to harden APIs and improve cloud security hygiene.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports