Computer Software/Engineering
Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.
Explore Other Sectors
Computer Software/Engineering Threat Reports
Hermes AI Agent's Role in Thai Finance Ministry Cyberattack
In July 2026, threat intelligence firm Hunt.io and security researcher Bob Diachenko uncovered a cyberattack targeting Thailand's Ministry of Finance. The attackers utilized the open-source Hermes AI agent in its unattended 'YOLO' mode to automate post-exploitation activities. Evidence from exposed web directories indicated that multiple systems within the ministry's network were compromised. The attack involved deploying web shells, exploiting internal services such as Hadoop and Apache Ambari, and attempting to access personnel records dating back to 2012. Despite these findings, the Ministry of Finance has not confirmed the breach. This incident underscores the escalating use of autonomous AI agents in cyberattacks, highlighting the need for enhanced security measures against AI-driven threats. The ability of AI agents to operate independently and execute complex attack sequences poses significant challenges for traditional cybersecurity defenses.
1 month ago
Kill Chain
BlueNoroff's 2026 Zoom Phishing Campaign: A Wake-Up Call for Crypto Firms
In July 2026, the North Korean state-sponsored group BlueNoroff launched a sophisticated phishing campaign targeting cryptocurrency organizations. The attackers utilized typosquatted Zoom and Microsoft Teams domains to impersonate legitimate videoconferencing platforms. By hijacking trusted Telegram accounts, they invited high-ranking employees to fake meetings, where victims were prompted to grant webcam access. This access allowed the attackers to profile victims' cryptocurrency wallets before delivering malware, enabling selective targeting of high-value individuals. This incident underscores the evolving tactics of threat actors who exploit trust in widely used communication platforms. The integration of social engineering with advanced reconnaissance techniques highlights the need for heightened vigilance and robust security measures within the cryptocurrency sector.
1 month ago
Kill Chain
HollowGraph Malware: Exploiting Microsoft 365 Calendars for Stealthy Cyber-Espionage
In July 2026, cybersecurity researchers uncovered HollowGraph, a sophisticated malware that exploits Microsoft 365 calendar events for covert command-and-control (C2) communication and data exfiltration. By embedding encrypted instructions and stolen data within calendar events dated far into the future (e.g., May 13, 2050), HollowGraph effectively evades detection by blending malicious activities with legitimate Microsoft Graph API traffic. This technique has been observed targeting at least 12 Israeli organizations, with active communications detected between June and July 2026. The malware's design allows it to bypass traditional security measures, posing significant risks to organizations relying on Microsoft 365 services. The emergence of HollowGraph underscores a growing trend where threat actors leverage trusted cloud services to conduct stealthy cyber-espionage campaigns. This incident highlights the critical need for organizations to enhance monitoring of cloud-based activities, implement robust identity and access management controls, and stay vigilant against novel attack vectors that exploit legitimate platforms for malicious purposes.
1 month ago
Kill Chain
UAC-0099's Innovative Use of Notepad++ Plugins in Malware Deployment
In July 2026, the Russia-aligned threat group UAC-0099 initiated a sophisticated phishing campaign targeting Ukrainian organizations. The attack began with emails containing image attachments that, when clicked, redirected victims to download a ZIP archive. This archive included a VBScript disguised as a PDF, which, upon execution, installed a legitimate version of Notepad++ alongside a malicious plugin named LUNCHPOKE. This plugin facilitated the deployment of additional malware components, including BURNYBEAR and MATCHBOIL.V2, establishing persistence and enabling further malicious activities on the compromised systems. This incident underscores the evolving tactics of threat actors who exploit trusted software to deliver malware, bypassing traditional security measures. The use of legitimate applications like Notepad++ as delivery mechanisms highlights the need for heightened vigilance and advanced detection capabilities to identify and mitigate such sophisticated threats.
1 month ago
Kill Chain
NodeBB Urges Immediate Update Following Discovery of Critical Vulnerabilities
In July 2026, Aikido Security's AI-driven penetration testing agents identified eight high-severity vulnerabilities in NodeBB, an open-source forum software. These flaws, present in all versions prior to 4.14.0, allowed unauthorized access to administrative dashboards, exposure of private messages, and execution of arbitrary code through cross-site scripting. NodeBB addressed these issues in version 4.14.2, urging administrators to update promptly to mitigate potential exploits. This incident underscores the growing role of AI in both identifying and potentially exploiting software vulnerabilities. Organizations must remain vigilant, ensuring timely updates and adopting proactive security measures to defend against increasingly sophisticated threats.
1 month ago
Kill Chain
Critical Command Injection Vulnerability in Microsoft Bing Images (CVE-2026-32194)
In March 2026, a critical command injection vulnerability (CVE-2026-32194) was discovered in Microsoft Bing Images, allowing unauthorized attackers to execute arbitrary code over a network. This flaw stemmed from improper neutralization of special elements used in commands, enabling remote code execution with high privileges. Microsoft promptly addressed the issue by releasing a security update to mitigate the risk. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-32194?utm_source=openai)) This incident underscores the persistent threat of command injection vulnerabilities in web services, highlighting the necessity for continuous security assessments and prompt patch management to protect against potential exploits.
1 month ago
Kill Chain
ChatGPT's 'AgentForger' Vulnerability: A Wake-Up Call for AI Security
In June 2026, Zenity Labs identified a critical vulnerability in OpenAI's ChatGPT Workspace Agents, termed 'AgentForger.' This flaw allowed attackers to craft a phishing link that, when clicked by an employee, could silently create and deploy an autonomous AI agent within the organization's ChatGPT environment. This rogue agent would inherit the employee's identity and access privileges, operating without the employee's knowledge or consent. OpenAI addressed and patched this vulnerability by June 8, 2026. ([zenity.io](https://zenity.io/company-overview/newsroom/company-news/zenity-labs-uncovers-agentforger-a-chatgpt-vulnerability?utm_source=openai)) The 'AgentForger' incident underscores the evolving nature of cyber threats targeting AI systems. As organizations increasingly integrate AI agents into their workflows, ensuring robust security measures and prompt vulnerability management becomes paramount to prevent unauthorized access and potential data breaches.
1 month ago
Kill Chain
Hackers Exploit Notepad++ Plugins to Install Malware - July 2026
In July 2026, Ukraine's CERT-UA identified a cyberattack campaign by the threat group UAC-0099, which distributed a ZIP archive containing the legitimate Notepad++ application alongside a malicious plugin named LunchPoke. This plugin established persistence on infected systems. The attackers employed a VBS script disguised as a PDF to initiate the infection chain, leading to the installation of additional malware components, including BurnyBear and MatchBoil V2 loaders. The campaign primarily targeted organizations in Ukraine and is linked to the APT44 group, also known as Sandworm. This incident underscores the evolving tactics of threat actors who exploit trusted software to deliver malware, highlighting the need for organizations to scrutinize software sources and implement robust security measures to detect and prevent such sophisticated attacks.
1 month ago
Kill Chain
Fake Claude App via Bing Ads Delivers SectopRAT Malware
In July 2026, a sophisticated malvertising campaign named 'FakeAgent' exploited Bing advertisements to distribute the SectopRAT malware. Attackers created a fake Claude desktop application installer, hosted on a legitimate Claude.ai domain, which was promoted through Bing ads. Unsuspecting users searching for the Claude desktop app were redirected to this malicious installer, leading to the compromise of at least 29 organizations over a two-day period. The malware, SectopRAT, is a remote access trojan with information-stealing capabilities, allowing attackers to exfiltrate sensitive data and maintain persistent access to infected systems. This incident underscores the evolving tactics of cybercriminals who leverage legitimate platforms and advertising services to disseminate malware. The use of authentic domains and sophisticated social engineering techniques highlights the need for heightened vigilance among users and organizations. It also emphasizes the importance of downloading software exclusively from official and verified sources to mitigate the risk of such deceptive attacks.
1 month ago
Kill Chain
Emerging Cyber Threats: Android Spyware, PLC Attacks, and AI Image Prompt Injections
In July 2026, a series of sophisticated cyber threats emerged, including Android spyware, PLC attacks, and AI image prompt injections. These incidents involved malicious packages stealing data, counterfeit extensions enabling remote access, and images embedding hidden commands to manipulate AI agents. Such attacks exploited vulnerabilities in open systems, weak code, and standard network traffic, posing significant risks to both individual users and organizations. The current relevance of these incidents lies in the evolving nature of cyber threats, where attackers increasingly leverage advanced techniques to infiltrate systems. The rise in AI-driven attacks and the exploitation of everyday applications underscore the need for heightened vigilance and robust security measures to protect against such multifaceted threats.
1 month ago
Kill Chain
Dolphin X Malware: AI-Powered Threat Targeting High-Value Victims
In July 2026, cybersecurity researchers identified 'Dolphin X,' a sophisticated Windows-based remote access trojan (RAT) and infostealer. This malware targets over 300 applications, including browsers, cryptocurrency wallets, password managers, and cloud command-line tools. Notably, Dolphin X incorporates an AI-powered profiling system that analyzes infected systems' application usage, browsing history, and installed software to assign risk scores. These scores enable attackers to prioritize high-value targets, such as developers with access to sensitive cloud production environments. The malware is marketed on cybercrime forums under a malware-as-a-service model, with subscription tiers offering varying levels of obfuscation and feature sets. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-dolphin-x-malware-uses-ai-to-rank-high-value-targets/?utm_source=openai)) The emergence of Dolphin X underscores a concerning trend: the integration of artificial intelligence into cybercriminal tools to enhance operational efficiency and target selection. This development highlights the need for organizations to bolster their cybersecurity defenses, particularly in protecting developer workstations and sensitive credentials, to mitigate the risks posed by such advanced threats.
1 month ago
Kill Chain
SANDWORM_MODE: Unveiling the npm Supply Chain Attack on AI Development Tools
In February 2026, the SANDWORM_MODE malware campaign targeted the npm ecosystem by distributing 19 typosquatted packages under aliases 'official334' and 'javaorg'. Upon installation, these packages executed a multi-stage attack: initially harvesting developer credentials and environment variables, followed by deploying a malicious MCP server to compromise AI coding assistants. The malware propagated by injecting itself into GitHub repositories and CI/CD pipelines, exfiltrating sensitive data, and, if thwarted, activating a destructive fallback to erase user files. ([crowdstrike.com](https://www.crowdstrike.com/en-us/blog/denying-the-worm-sandworm-mode-and-ai-toolchain-supply-chain-attacks/?utm_source=openai)) This incident underscores the escalating sophistication of supply chain attacks, particularly those exploiting AI development tools. Organizations must enhance their security measures to detect and prevent such multi-faceted threats that blend into legitimate development workflows.
1 month ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports