Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Computer Software/Engineering

Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.

2541 threat reports
Page 35 of 212
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Computer Software/Engineering Threat Reports

Showing 409–420 / 2541 reports
Chinese AI Companies Accused of Massive Intellectual Property Theft Through Model Distillation
Chinese AI Companies Accused of Massive Intellectual Property Theft Through Model Distillation
Computer Software/Engineering2 months ago

Chinese AI Companies Accused of Massive Intellectual Property Theft Through Model Distillation

U.S. intelligence agencies NSA, CISA, and FBI have accused Chinese AI companies including DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI of conducting systematic industrial-scale distillation attacks against American frontier AI models since late 2024. These companies extracted billions of tokens from Anthropic Claude, OpenAI GPT, Google Gemini, and SpaceXAI Grok models through bulk premium subscriptions, API abuse, and proxy networks to circumvent geographic restrictions. The attacks violated terms of service and resulted in significantly reduced development timelines and costs for Chinese AI models while undermining intellectual property protections of U.S. companies. This incident highlights the evolving landscape of AI-powered intellectual property theft and the increasing sophistication of state-sponsored technology transfer operations, demonstrating how legitimate AI research techniques can be weaponized for competitive advantage at national scales.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Industrial-Scale AI Theft: How Chinese Companies Systematically Extracted US Frontier Model Capabilities
Industrial-Scale AI Theft: How Chinese Companies Systematically Extracted US Frontier Model Capabilities
Computer Software/Engineering2 months ago

Industrial-Scale AI Theft: How Chinese Companies Systematically Extracted US Frontier Model Capabilities

Since late 2024, Chinese artificial intelligence companies including DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI have conducted systematic industrial-scale knowledge distillation campaigns against U.S. frontier AI models including Claude, GPT, Gemini, and Grok. These companies extracted billions of tokens across millions of API requests, violating terms of service while using sophisticated techniques including chain-of-thought reasoning extraction, automated failover systems, and gray market proxy networks to bypass geographic restrictions. The campaigns represent a core component of Chinese AI development strategy rather than supplementary research, enabling significantly reduced development costs and accelerated model training timelines while threatening U.S. technological leadership in artificial intelligence. This incident highlights the emerging threat of AI model theft through systematic knowledge distillation, representing a new category of intellectual property theft that combines traditional cybersecurity evasion techniques with advanced AI research methodologies, requiring coordinated industry-wide defensive measures.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical AI Security Gap: DeepSeek Harness Sandbox Escape Exposes Autonomous Agent Risks
Critical AI Security Gap: DeepSeek Harness Sandbox Escape Exposes Autonomous Agent Risks
Computer Software/Engineering2 months ago

Critical AI Security Gap: DeepSeek Harness Sandbox Escape Exposes Autonomous Agent Risks

In August 2026, a critical vulnerability (CVE-2026-82533) was discovered in DeepSeek Harness, an open-source AI coding agent tool with over 216,000 GitHub stars. The flaw allowed sandboxed AI agents to disable their own security sandbox through a single command, bypassing file system protections designed to prevent untrusted code execution. Attackers could exploit this by supplying malicious text that prompted the agent to call the tool's local web interface, switching to 'danger-full-access' mode without approval prompts. The vulnerability stemmed from inadequate authentication on the local interface and improper host header validation, enabling both local sandbox escapes and potential remote exploitation through port forwarding. This incident highlights the growing security challenges in AI development tools as organizations increasingly adopt autonomous coding agents. The vulnerability demonstrates how AI agents can be manipulated to bypass their own safety mechanisms, representing a new class of security risks in the rapidly expanding AI development ecosystem.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(low)
Read report
Critical Alby Hub Vulnerability Exposed Bitcoin Wallets to Complete Takeover
Critical Alby Hub Vulnerability Exposed Bitcoin Wallets to Complete Takeover
Financial Services2 months ago

Critical Alby Hub Vulnerability Exposed Bitcoin Wallets to Complete Takeover

In September 2026, Bitcoin wallet company Alby disclosed a critical vulnerability in Alby Hub versions v1.7.0 through v1.18.5 that allowed attackers to completely take over internet-exposed Lightning wallets and drain funds. The flaw affected self-hosted Bitcoin wallets where owners had inadvertently exposed their Hub management interfaces to the public internet, often following Alby's own documentation that recommended such configurations. At least one user was confirmed affected, with the company providing limited details about the vulnerability mechanism pending responsible disclosure. The incident highlights the ongoing security challenges in cryptocurrency infrastructure, particularly as Bitcoin adoption accelerates and self-custody solutions become more mainstream. With ransomware groups increasingly targeting cryptocurrency platforms and the rise of state-sponsored attacks on financial infrastructure, vulnerabilities in wallet software present critical risks to both individual users and the broader digital asset ecosystem.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Massive Infostealer Campaign Exposes Thousands of AI Service Tokens, Bypassing MFA Protection
Massive Infostealer Campaign Exposes Thousands of AI Service Tokens, Bypassing MFA Protection
Computer Software/Engineering2 months ago

Massive Infostealer Campaign Exposes Thousands of AI Service Tokens, Bypassing MFA Protection

In August 2026, cybersecurity researchers analyzed a 7GB infostealer dump containing data from 5,871 infected machines across 162 countries, revealing thousands of unexpired authentication tokens for AI services including Google, OpenAI, Anthropic, and others. Information stealers like Lumma Stealer and Vidar harvested session tokens, API keys, and JSON Web Tokens (JWTs) that threat actors can replay to bypass credential-based authentication and multi-factor authentication, effectively gaining unauthorized access to premium AI services without traditional login processes. The stolen data included 555 AI-related JWTs and 2,937 encrypted tokens, with 17.7% containing plaintext personally identifiable information, enabling account takeovers, resource theft, and unauthorized AI service usage sold on underground markets. This incident highlights the growing cybercriminal focus on AI credential theft as premium model access costs create strong financial incentives for stealing rather than purchasing legitimate access, while the proliferation of anti-detect browsers and session replay tools makes monetizing these stolen tokens increasingly accessible to threat actors.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Critical Vulnerability in Lean Theorem Prover Enables Fabrication of Mathematical Proofs
Critical Vulnerability in Lean Theorem Prover Enables Fabrication of Mathematical Proofs
Computer Software/Engineering2 months ago

Critical Vulnerability in Lean Theorem Prover Enables Fabrication of Mathematical Proofs

Trail of Bits researchers discovered a critical vulnerability in Lean 4 theorem prover versions up to 4.33.1 that allowed fabrication of mathematical proofs through string manipulation exploits. The flaw in String.Pos.Raw.extract function created inconsistencies between logical definitions and compiled native code, enabling attackers to manufacture contradictions and prove false theorems, including a bogus proof of Fermat's Last Theorem. This supply-chain vulnerability affects the integrity of formal verification systems used in critical software development and mathematical research. This incident highlights the emerging risks in AI-assisted code generation and formal verification tools as they become integral to software supply chains. With increasing reliance on theorem provers for security-critical applications, vulnerabilities in these foundational tools pose systemic risks to mathematical proofs and software verification processes.

Critical impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(high)
Read report
Chinese AI Giants Caught in Massive U.S. Model Distillation Campaign
Chinese AI Giants Caught in Massive U.S. Model Distillation Campaign
Computer Software/Engineering2 months ago

Chinese AI Giants Caught in Massive U.S. Model Distillation Campaign

In 2024, Chinese AI companies including DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI engaged in systematic distillation of U.S. frontier AI models according to a joint advisory from NSA, CISA, and FBI. The companies spent billions of tokens across millions of exchanges with models like Claude, ChatGPT, Google Gemini, and xAI's Grok to extract proprietary capabilities and strengthen their domestic AI systems. The attackers used sophisticated evasion techniques including distributed accounts, proxy networks, third-party aggregators, and gray market access to circumvent geographic restrictions and detection mechanisms. This incident highlights the growing threat of AI-enabled economic espionage as artificial intelligence becomes central to national competitiveness, with state-sponsored actors leveraging legitimate AI APIs for large-scale intellectual property theft through automated distillation campaigns.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
DoppelCart Fraud Network Exposes Massive E-Commerce Security Gap
DoppelCart Fraud Network Exposes Massive E-Commerce Security Gap
Retail Industry2 months ago

DoppelCart Fraud Network Exposes Massive E-Commerce Security Gap

In September 2026, cybersecurity researchers discovered DoppelCart, the largest documented fake e-commerce network comprising over 119,000 fraudulent domains, primarily using the .SHOP TLD. The operation impersonates 44,182 legitimate brands by copying product catalogs and branding, then uses WebSocket connections to steal payment card data, CVV codes, and personal information in real-time during checkout. The network affects 2.72% of all .SHOP domains and significantly surpasses previous operations like BogusBazaar's 75,000 sites, with over 105,000 shops remaining active at discovery. This incident highlights the evolving sophistication of financial fraud networks and their ability to operate at unprecedented scale through automated domain generation and brand impersonation, representing a critical threat to consumer trust and e-commerce security.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
StyleSmuggler Zero-Day: How CVE-2026-75650 Compromised Magento E-commerce Security
StyleSmuggler Zero-Day: How CVE-2026-75650 Compromised Magento E-commerce Security
Retail Industry2 months ago

StyleSmuggler Zero-Day: How CVE-2026-75650 Compromised Magento E-commerce Security

In September 2026, threat actors began exploiting CVE-2026-75650 (StyleSmuggler), a critical zero-day vulnerability in Adobe Commerce and Magento Open Source with a CVSS score of 10.0. The flaw allows unauthenticated remote code execution through PHP code injection in Magento's template system, specifically targeting the 'Payment Transaction Failed Reminder' email function. Attackers deployed sophisticated payloads including a Rust-based Linux backdoor and PHP web shells on compromised e-commerce sites, with exploitation beginning September 4, 2026. This incident highlights the growing sophistication of supply chain attacks targeting e-commerce platforms, as attackers increasingly focus on high-value web applications that process financial transactions and customer data, demonstrating the critical need for runtime application security controls.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Grindr's £26 Million Settlement Exposes Critical Gaps in Dating App Data Privacy
Grindr's £26 Million Settlement Exposes Critical Gaps in Dating App Data Privacy
Computer Software/Engineering2 months ago

Grindr's £26 Million Settlement Exposes Critical Gaps in Dating App Data Privacy

In September 2026, Grindr agreed to pay £26 million ($35.1 million) to settle a U.K. class action lawsuit involving over 10,000 users whose sensitive personal data, including HIV status, was shared with third-party advertising companies Apptimize and Localytics between 2018-2020. The incident, originally exposed by Norwegian research group SINTEF in April 2018, occurred while Grindr was owned by Chinese gaming company Kunlun, before its 2020 acquisition by San Vicente Acquisition LLC. The settlement covers historical data practices that violated U.K. privacy laws through unauthorized sharing of location data, sexual orientation, and medical information for commercial advertising purposes. This incident highlights the ongoing regulatory scrutiny of data privacy violations in dating apps and social platforms, particularly as GDPR enforcement intensifies and class action lawsuits become more prevalent in addressing historical privacy breaches involving sensitive personal information.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
BengalSEO Campaign Weaponizes Search Results for MayaBot Distribution
BengalSEO Campaign Weaponizes Search Results for MayaBot Distribution
Information Technology/IT2 months ago

BengalSEO Campaign Weaponizes Search Results for MayaBot Distribution

The BengalSEO campaign represents a sophisticated search engine optimization poisoning operation that has been active since 2015, targeting Bing search results to deliver MayaBot malware and facilitate tech support scams. Operating from Rajasthan, India, the threat actors behind this campaign manipulate search engine results to redirect victims to malicious websites, where they deploy malware or engage in fraudulent technical support schemes. The campaign demonstrates the evolution of SEO poisoning techniques and their effectiveness in reaching unsuspecting users through legitimate search queries. This incident highlights the growing sophistication of search engine manipulation attacks and their integration with traditional malware distribution methods. As organizations increasingly rely on digital visibility and search engine optimization, the weaponization of these same techniques by threat actors represents a significant shift in attack vectors that security teams must address.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
When AI Attacks AI: The 2026 Autonomous Agent Credential Harvesting Campaign
When AI Attacks AI: The 2026 Autonomous Agent Credential Harvesting Campaign
Computer Software/Engineering2 months ago

When AI Attacks AI: The 2026 Autonomous Agent Credential Harvesting Campaign

In September 2026, threat actors deployed autonomous AI agent frameworks to conduct large-scale credential harvesting operations, compromising thousands of third-party credentials in under six hours. Google Threat Intelligence Group identified multiple financially motivated groups, including TeamPCP, leveraging AI-assisted tools like DUSTMAKER malware to target AI coding assistants, cloud environments, and supply chains across PyPI, npm, and Docker Hub repositories. The attacks demonstrated unprecedented automation capabilities, with AI systems autonomously managing vulnerability scanning, real-time troubleshooting, and IP rotation without human intervention. This incident represents a critical escalation in AI-enabled cyber threats, coinciding with the rapid adoption of generative AI tools in enterprise environments and the emergence of 'abliterated' open-weight models that bypass safety guardrails.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports