Computer Software/Engineering
Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.
Explore Other Sectors
Computer Software/Engineering Threat Reports
OkoBot Malware: A New Threat to Cryptocurrency Security
In July 2026, cybersecurity researchers identified OkoBot, a sophisticated malware framework comprising over 20 modules designed to steal cryptocurrency wallet seed phrases, credentials, and other sensitive data. OkoBot infiltrates systems through deceptive ClickFix attacks and malicious GitHub repositories masquerading as legitimate software tools. Once installed, it deploys various payloads, including browser injectors and keyloggers, to harvest user information and monitor activities. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-okobot-framework-deploys-20-payloads-to-steal-data-crypto/?utm_source=openai)) The emergence of OkoBot underscores a growing trend of targeted attacks on cryptocurrency users, highlighting the need for enhanced vigilance and robust security measures within the crypto community. As the malware continues to evolve, staying informed about such threats is crucial for safeguarding digital assets.
2 months ago
Kill Chain
Critical Vulnerability in Claude Chrome Extension Exposes User Data
In July 2026, a critical vulnerability was discovered in Anthropic's Claude for Chrome browser extension. This flaw allowed malicious extensions to simulate user interactions, triggering predefined AI actions without user consent. Exploiting this, attackers could access connected services such as Gmail, Google Docs, Google Calendar, and Salesforce, leading to unauthorized data access and potential data exfiltration. The vulnerability stemmed from the extension's failure to verify the origin of click events, accepting synthetic events generated by other extensions as legitimate user actions. This incident underscores the growing risks associated with browser extensions and their integration with AI-powered services. As organizations increasingly adopt such tools to enhance productivity, ensuring robust security measures and thorough validation of user interactions becomes imperative to prevent unauthorized access and data breaches.
2 months ago
Kill Chain
ClickLock: The New macOS Malware Exploiting User Trust
In July 2026, cybersecurity researchers identified a new macOS malware named ClickLock, which employs social engineering tactics to deceive users into revealing their system login passwords. The malware initiates by presenting a fake Cloudflare 'human verification' prompt, leading users to execute a command in the Terminal. This action triggers the download of malicious modules that disable keyboard interrupts and suppress system notifications. Subsequently, ClickLock displays a counterfeit macOS password dialog, coercing users into entering their credentials. Upon obtaining the password, the malware exfiltrates sensitive data, including login credentials, cryptocurrency assets, and browser information, to the attackers via Telegram. Additionally, it installs a persistent backdoor, granting ongoing remote access to the compromised systems. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-clicklock-macos-malware-traps-users-into-revealing-login-password/?utm_source=openai)) The emergence of ClickLock underscores a growing trend in macOS-targeted malware leveraging sophisticated social engineering techniques. This incident highlights the necessity for heightened user awareness and the implementation of robust security measures to counteract such deceptive attacks.
2 months ago
Kill Chain
Outdated UEFI Bootloaders Pose Security Risks
In July 2026, researchers identified 11 outdated UEFI shim bootloaders, all signed by Microsoft, that remained trusted components within the Secure Boot framework. These bootloaders, versions 0.9 and earlier, lacked modern security protections and could be exploited by attackers to bypass Secure Boot, allowing the execution of malicious code during the boot process and establishing persistent access below the operating system level. Microsoft addressed the issue by revoking these vulnerable bootloaders in June 2026 through Secure Boot revocation updates. However, systems that have not applied these updates remain susceptible to boot-level attacks, as the revoked shims continue to be trusted on unpatched machines. This incident underscores the critical importance of timely firmware updates and the need for organizations to maintain vigilance over the security of their boot processes to prevent potential exploits.
2 months ago
Kill Chain
OpenAI's GPT-Red: Revolutionizing AI Security with Automated Prompt Injection Testing
In July 2026, OpenAI unveiled GPT-Red, an internal AI model designed to autonomously identify and exploit prompt injection vulnerabilities within its own AI systems. This initiative aims to proactively detect and mitigate security flaws before deployment. GPT-Red demonstrated a remarkable success rate, identifying vulnerabilities in 84% of test scenarios, significantly outperforming human red-teamers who achieved a 13% success rate. The model employs self-play reinforcement learning, continuously refining its attack strategies to uncover weaknesses that might be overlooked by human testers. This proactive approach underscores OpenAI's commitment to enhancing the robustness and security of its AI models. The introduction of GPT-Red highlights the escalating sophistication of AI-driven security testing. As AI systems become more integrated into critical applications, the ability to autonomously identify and address vulnerabilities is crucial. This development also reflects a broader industry trend towards leveraging AI for cybersecurity, emphasizing the need for continuous innovation to stay ahead of emerging threats.
2 months ago
Kill Chain
Daxin and Stupig Malware Resurface in Taiwan Manufacturing Firm
In May 2026, Symantec's Threat Hunter Team identified the re-emergence of Backdoor.Daxin, a sophisticated kernel-mode rootkit previously linked to China-based threat actors, on a compromised host within a Taiwan-based subsidiary of a multinational high-tech manufacturer. Alongside Daxin, researchers discovered a novel backdoor named Stupig, which exploits a trojanized keyboard-layout DLL to execute commands with SYSTEM privileges directly from the Windows logon screen, bypassing standard authentication mechanisms. Both malware samples carry compile timestamps from early 2013, suggesting a prolonged undetected presence of up to 13 years within the victim's network. This incident underscores the persistent and evolving nature of cyber threats targeting critical infrastructure and high-tech industries. The discovery of Stupig's unique pre-authentication execution method highlights the need for continuous vigilance and advanced detection capabilities to identify and mitigate such stealthy intrusions.
2 months ago
Kill Chain
Agent Data Injection: A New Frontier in AI Security Threats
In July 2026, researchers from Seoul National University, the University of Illinois Urbana-Champaign, and Largosoft identified a novel cybersecurity threat termed Agent Data Injection (ADI). This attack manipulates AI agents by embedding malicious data within trusted inputs, such as sender names or button IDs, leading the agents to perform unintended actions like unauthorized purchases or executing attacker commands. Unlike traditional prompt injections that insert overt instructions, ADI subtly corrupts the data AI agents rely upon, making detection challenging. The researchers demonstrated ADI's effectiveness across various platforms, including web agents like Claude in Chrome and coding assistants such as OpenAI's Codex, highlighting the vulnerability of AI systems to this sophisticated form of data manipulation. The emergence of ADI underscores the evolving landscape of AI security threats. As AI agents become more integrated into critical applications, the potential for such attacks to cause significant harm increases. This incident serves as a crucial reminder for organizations to reassess and fortify their AI security measures to mitigate the risks associated with data manipulation attacks.
2 months ago
Kill Chain
AsyncAPI npm Supply Chain Attack: A Wake-Up Call for Open-Source Security
In July 2026, a sophisticated supply chain attack targeted the AsyncAPI project, resulting in the publication of five malicious versions of its npm packages. The attacker exploited misconfigured GitHub Actions workflows to inject a remote access trojan (RAT) into the @asyncapi namespace, affecting packages with a cumulative weekly download count exceeding 2.25 million. The compromised packages included @asyncapi/generator, @asyncapi/generator-helpers, @asyncapi/generator-components, and @asyncapi/specs. The attack involved multiple stages, with the final payload establishing persistence and exfiltrating sensitive data such as credentials, authentication keys, and tokens. This incident underscores the critical need for securing CI/CD pipelines and the potential risks associated with open-source software dependencies. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/-asyncapi-npm-packages-infected-with-credential-stealing-malware/?utm_source=openai)) The AsyncAPI supply chain attack highlights a growing trend of targeting software development infrastructure to distribute malware. As organizations increasingly rely on open-source components, ensuring the integrity of these dependencies becomes paramount. This incident serves as a stark reminder of the vulnerabilities inherent in the software supply chain and the necessity for robust security measures to protect against such sophisticated attacks.
2 months ago
Kill Chain
AI Tools in Cyberattacks: The Misuse of Google's Gemini CLI
In mid-2026, a Russian-speaking threat actor known as "bandcampro" exploited Google's open-source Gemini CLI AI tool to orchestrate a small-scale botnet targeting a dental clinic's systems. Over approximately two months, the attacker utilized the AI agent to deploy and manage infrastructure controlling eight systems, gaining unauthorized access to the OpenDental database. The AI facilitated tasks such as troubleshooting, operational improvements, and command-and-control (C2) migration, demonstrating advanced capabilities in automating cyberattack processes. This incident underscores the evolving landscape of cyber threats, where adversaries increasingly leverage AI tools to enhance the efficiency and sophistication of their operations. The misuse of AI in cyberattacks highlights the urgent need for robust security measures and vigilant monitoring to detect and mitigate such advanced threats.
2 months ago
Kill Chain
Dutch Authorities Dismantle €100 Million Investment Fraud Network
In July 2026, Dutch authorities dismantled a sophisticated international investment fraud scheme that operated 20 call centers across multiple countries, employing over 700 individuals posing as financial advisors. The organization is estimated to have defrauded tens of thousands of victims, amassing over €100 million per month at its peak. The fraudsters built trust with victims over extended periods, introducing them to realistic-looking investment platforms that displayed fictitious profits. Victims were persuaded to increase their investments, often through cryptocurrency transfers, while the criminals siphoned the funds and presented fake dashboards showing inflated returns. This incident underscores the evolving complexity and scale of cyber-enabled financial fraud, highlighting the need for enhanced vigilance and regulatory measures in the financial sector. The use of sophisticated social engineering tactics and the exploitation of cryptocurrency platforms for illicit gains reflect broader trends in cybercrime, necessitating continuous adaptation of security strategies by organizations and individuals alike.
2 months ago
Kill Chain
Critical 'PromptFiction' Vulnerability in Claude Desktop Exposes AI to Malicious Prompts
In July 2026, a critical vulnerability named 'PromptFiction' was discovered in Anthropic's Claude Desktop application. This flaw allowed attackers to automatically submit malicious prompts to the AI assistant without any user interaction, leveraging a custom URI scheme ('claude://') to execute commands upon clicking a crafted link. Exploiting this, attackers could exfiltrate sensitive user data and potentially execute remote code on the victim's machine. The vulnerability was promptly patched in Claude Desktop version 1.1.2321. This incident underscores the evolving nature of prompt injection attacks, highlighting the need for robust security measures in AI applications to prevent unauthorized access and data breaches.
2 months ago
Kill Chain
Critical Vulnerabilities in Cursor AI IDE Expose Developers to Remote Code Execution
In early 2026, multiple critical vulnerabilities were discovered in the Cursor AI-integrated development environment (IDE), notably CVE-2026-50548 and CVE-2026-50549. These flaws allowed attackers to escape the IDE's sandbox environment, enabling remote code execution (RCE) on developers' machines. Exploits involved manipulating the working directory parameter and leveraging symbolic link (symlink) manipulation to bypass security controls. The vulnerabilities posed significant risks, including unauthorized access to source code, sensitive data exposure, and potential compromise of development environments. ([csoonline.com](https://www.csoonline.com/article/4191923/sandbox-bypass-flaws-in-cursor-ide-highlight-prompt-injection-as-an-rce-vector.html?utm_source=openai)) The discovery of these vulnerabilities underscores the growing security challenges associated with AI-assisted development tools. As organizations increasingly adopt such tools to enhance productivity, it is imperative to implement robust security measures to mitigate risks associated with prompt injection attacks and sandbox escapes. This incident highlights the need for continuous monitoring and updating of AI development environments to safeguard against emerging threats.
2 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports