Computer Software/Engineering
Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.
Explore Other Sectors
Computer Software/Engineering Threat Reports
Protecting SaaS Applications from ShinyHunters' OAuth Exploits
Between mid-2025 and mid-2026, the cybercriminal group ShinyHunters executed a series of sophisticated attacks targeting SaaS-based applications, notably Salesforce. Utilizing techniques such as voice phishing (vishing), supply chain compromises, and exploiting misconfigured guest access, they abused trusted OAuth relationships to gain unauthorized access, exfiltrate data, and establish persistent footholds within organizations. These methods allowed them to inherit user and application privileges, enabling extensive enumeration and querying of customer relationship management (CRM) records while evading traditional authentication detections. The campaigns impacted multiple industries, including retail, education, and manufacturing, underscoring the critical need for vigilant monitoring of OAuth-connected applications, thorough validation of third-party integrations, and stringent review of guest access configurations. The relevance of this incident is heightened by the increasing prevalence of similar tactics employed by threat actors to exploit OAuth mechanisms and third-party integrations. Organizations must recognize the evolving threat landscape where attackers leverage trusted relationships and social engineering to bypass conventional security measures. This trend emphasizes the urgency for enhanced detection capabilities, improved visibility into connected applications, and the implementation of robust security practices to safeguard against such sophisticated attacks.
2 months ago
Kill Chain
CrashStealer: New macOS Malware Impersonates Apple CrashReporter
In early July 2026, security researchers identified 'CrashStealer,' a sophisticated macOS infostealer malware that masquerades as Apple's CrashReporter tool. Delivered through a signed and notarized installer named 'Werkbit Setup,' CrashStealer bypasses macOS's Gatekeeper protections. Once executed, it prompts users with a fake system password request to gain access to the Keychain, subsequently exfiltrating sensitive data including browser credentials, cookies, and cryptocurrency wallet information. The malware employs advanced techniques such as client-side AES-256-GCM encryption for data exfiltration and re-signing its binary to evade detection. This incident underscores a growing trend of macOS-targeted malware leveraging social engineering and legitimate-looking applications to infiltrate systems. Organizations must enhance their security posture by implementing robust endpoint protection, user education on phishing tactics, and continuous monitoring to detect and mitigate such threats.
2 months ago
Kill Chain
CISA Issues Urgent Alert on Joomla RCE Vulnerabilities
In July 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a warning about active exploitation of critical remote code execution (RCE) vulnerabilities in Joomla extensions, specifically iCagenda and Balbooa Forms. These vulnerabilities, identified as CVE-2026-48939 and CVE-2026-56291 respectively, allow unauthenticated attackers to upload arbitrary files, including malicious PHP scripts, leading to full website compromise. The flaws were exploited in automated attacks before patches were released, prompting CISA to mandate immediate remediation for federal agencies. This incident underscores the persistent threat posed by web application vulnerabilities, particularly in widely used content management systems like Joomla. The rapid exploitation of these flaws highlights the importance of timely patching and proactive security measures to protect web assets from emerging threats.
2 months ago
Kill Chain
Jscrambler npm Package Compromise: A Wake-Up Call for Supply Chain Security
In July 2026, Jscrambler's npm package was compromised, leading to the publication of malicious versions (8.14, 8.16, 8.17, and 8.20) containing an infostealer malware executed during the 'preinstall' hook. This breach resulted in approximately 1,500 downloads within a two-hour window before the issue was addressed. The malware targeted sensitive data, including source code, developer credentials, cloud service keys, and cryptocurrency wallets. Jscrambler promptly deprecated the affected versions and released a secure version 8.22. This incident underscores the critical importance of securing software supply chains, as attackers increasingly exploit trusted development tools to distribute malware. Organizations must implement stringent security measures, such as code integrity checks and continuous monitoring, to prevent similar supply chain attacks.
2 months ago
Kill Chain
CrashStealer: New macOS Malware Bypasses Gatekeeper
In early July 2026, cybersecurity researchers identified a new macOS information stealer named CrashStealer. This malware is delivered through a disk image that impersonates Apple's built-in crash-reporting component, aiming to deceive victims through a slight alteration in the application's name. Once executed, CrashStealer harvests sensitive data from browsers, cryptocurrency wallets, and password managers. Notably, it utilizes a notarized dropper to bypass macOS's Gatekeeper security feature, allowing it to execute without triggering security warnings. ([mactech.com](https://www.mactech.com/2026/07/13/jamf-threat-labs-releases-analysis-of-macos-info-stealer-dubbed-crashstealer/?utm_source=openai)) The emergence of CrashStealer underscores a growing trend of sophisticated malware targeting macOS systems. Attackers are increasingly leveraging social engineering tactics and exploiting trust in Apple's notarization process to distribute malicious software. This incident highlights the need for enhanced vigilance and security measures among macOS users to mitigate such evolving threats.
2 months ago
Kill Chain
ModHeader Extension Removed by Google and Microsoft Over Security Concerns
In July 2026, Google and Microsoft removed the ModHeader browser extension, which had approximately 1.6 million combined installs across Chrome and Edge, due to the discovery of a dormant data collection module. Security researchers found that version 7.0.18 of ModHeader contained code capable of collecting users' browsing histories and transmitting the encrypted data to an external server. Although the data collection feature was inactive, its presence raised significant privacy concerns, leading to the extension's removal from both browsers. This incident underscores the critical need for rigorous security assessments of browser extensions, especially those with extensive user bases. It highlights the potential risks associated with third-party software components and the importance of continuous monitoring to detect and mitigate hidden threats that could compromise user privacy and security.
2 months ago
Kill Chain
Yellow Teams: Defining the Future of AI Security
In 2026, organizations like Anthropic and OpenAI initiated projects such as Project Glasswing and Daybreak, respectively, to explore the integration of advanced AI models like Claude Mythos and GPT-5.5 into cybersecurity operations. These initiatives led to the formation of 'yellow teams'—engineering groups dedicated to developing both offensive and defensive AI tools. These teams collaborated with red (offensive) and blue (defensive) teams to harness AI capabilities for identifying vulnerabilities and enhancing security measures. The collaboration resulted in the discovery of numerous vulnerabilities, including some longstanding ones, and emphasized the necessity of integrating AI into the software development life cycle to proactively mitigate future threats. The emergence of yellow teams underscores a significant shift in cybersecurity strategies, highlighting the critical role of AI in both offensive and defensive operations. As AI technologies continue to evolve, the integration of such teams is essential for organizations aiming to stay ahead of sophisticated cyber threats and to adapt to the rapidly changing threat landscape.
2 months ago
Kill Chain
CISA's 2026 GitHub Credential Leak: Lessons in Security Oversight
In May 2026, the Cybersecurity and Infrastructure Security Agency (CISA) experienced a significant security lapse when a contractor inadvertently exposed sensitive credentials on a public GitHub repository named 'Private-CISA.' This repository, maintained by an employee of Nightwing—a contractor for CISA—contained approximately 844 MB of internal data, including administrative AWS GovCloud keys, plaintext passwords for internal systems, SSH keys, and SAML certificates. The repository was publicly accessible from November 2025 until its discovery in May 2026 by security researcher Guillaume Valadon of GitGuardian. Upon notification, CISA took steps to remove the repository and revoke the exposed credentials. ([techcrunch.com](https://techcrunch.com/2026/05/19/us-cyber-agency-cisa-exposed-reams-of-passwords-and-cloud-keys-to-the-open-web/?utm_source=openai)) This incident underscores the critical importance of stringent credential management and the need for continuous monitoring of public code repositories to prevent unauthorized data exposure. It also highlights the necessity for organizations, especially those responsible for national cybersecurity, to enforce robust security protocols and ensure that contractors adhere to the same standards to mitigate potential risks.
2 months ago
Kill Chain
Critical Remote Code Execution Vulnerability in iCagenda Joomla Extension (CVE-2026-48939)
In June 2026, a critical vulnerability (CVE-2026-48939) was identified in the iCagenda extension for Joomla, allowing unauthenticated attackers to upload and execute arbitrary PHP files via the file attachment feature. This flaw, present in versions prior to 3.9.15 and 4.0.8, enables remote code execution, potentially compromising the entire web server. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities catalog on July 10, 2026, following reports of active exploitation in the wild. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-48939?utm_source=openai)) The exploitation of CVE-2026-48939 underscores a broader trend of attackers targeting vulnerabilities in widely used content management system (CMS) extensions. This incident highlights the critical need for organizations to promptly apply security patches and maintain vigilant monitoring of their web applications to prevent unauthorized access and potential data breaches.
2 months ago
Kill Chain
MemGhost Attack: A New Threat to AI Assistant Security
In July 2026, cybersecurity researchers identified a novel attack vector named 'MemGhost,' which exploits AI assistants equipped with persistent memory. By sending a single, specially crafted email, attackers can implant false information into the assistant's memory without user detection. This manipulation allows the AI to provide altered responses in future interactions, potentially leading to misinformation or unauthorized actions. The attack leverages the assistant's ability to autonomously process emails and update its knowledge base, making it particularly insidious. The MemGhost attack underscores the emerging vulnerabilities associated with AI systems that maintain long-term user data. As AI assistants become more integrated into daily workflows, the potential for such memory poisoning attacks increases, highlighting the need for robust security measures to protect against unauthorized data manipulation.
2 months ago
Kill Chain
Anubis Ransomware Exploits Citrix Bleed 2 Vulnerability in 2026
In early July 2026, the Anubis ransomware group exploited a critical vulnerability known as Citrix Bleed 2 (CVE-2025-5777) in Citrix NetScaler appliances to gain unauthorized access to enterprise networks. This flaw allowed attackers to bypass multi-factor authentication by stealing session tokens, leading to the compromise of 91 organizations across sectors such as healthcare, financial services, manufacturing, and technology. The attackers utilized legitimate remote management tools to maintain persistence and evade detection, culminating in the deployment of ransomware that encrypted critical data and disrupted operations. This incident underscores the persistent threat posed by unpatched vulnerabilities and the sophisticated tactics employed by ransomware groups. The exploitation of Citrix Bleed 2 highlights the importance of timely patch management and the need for comprehensive monitoring of remote access tools to detect and prevent unauthorized activities.
2 months ago
Kill Chain
Urgent Alert: Widespread Scanning Targets MCP Servers and AI Assistant Credentials
In July 2026, security researchers identified a widespread scanning campaign targeting Model Context Protocol (MCP) servers and AI assistant credential files. Attackers systematically probed internet-facing systems for exposed MCP endpoints and configuration files associated with AI development tools, aiming to exploit misconfigurations and gain unauthorized access. This reconnaissance activity underscores the critical need for organizations to secure their AI infrastructure against emerging threats. The incident highlights a growing trend of attackers focusing on AI-related assets, exploiting the rapid adoption of AI technologies and potential security oversights. Organizations must proactively implement robust security measures to protect sensitive AI systems and data from evolving cyber threats.
2 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports