Computer Software/Engineering
Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.
Explore Other Sectors
Computer Software/Engineering Threat Reports
Unveiling the 2025 AWS Cryptomining Security Breach
In November 2025, Amazon Web Services (AWS) identified a sophisticated cryptocurrency mining campaign targeting Amazon EC2 and Amazon ECS services. Threat actors utilized compromised AWS Identity and Access Management (IAM) credentials to deploy mining operations rapidly, often within minutes of gaining access. They employed advanced persistence techniques, such as modifying instance attributes to disable termination, complicating incident response efforts. This campaign underscores the critical importance of securing IAM credentials and monitoring for unauthorized activities within cloud environments. The incident highlights a growing trend of attackers leveraging legitimate credentials to exploit cloud resources for illicit purposes. Organizations must prioritize robust access controls, implement multi-factor authentication, and continuously monitor for anomalous behaviors to mitigate such threats effectively.
3 months ago
Kill Chain
Salesforce Data Breach via Klue App Compromise
In June 2026, threat actors exploited OAuth tokens from Klue's Battlecards app to access Salesforce instances, leading to unauthorized data exfiltration. This incident mirrors previous breaches involving third-party integrations like Salesloft's Drift and Gainsight, highlighting the persistent risks associated with SaaS application connections. The attackers authenticated through a compromised Klue integration service account, generating OAuth tokens that granted access to customers' integrated Salesforce environments. The exfiltration process involved automated scripts querying the Salesforce REST API over a 24-hour period, with some instances experiencing concentrated bursts of nearly a thousand queries in 15 minutes. This breach underscores the critical need for organizations to scrutinize third-party integrations and enforce stringent security measures to protect sensitive data. The recurrence of such attacks emphasizes the importance of continuous monitoring and the implementation of robust security protocols to mitigate risks associated with third-party applications.
3 months ago
Kill Chain
DragonForce Ransomware's Stealthy Exploitation of Microsoft Teams
In December 2025, the DragonForce ransomware group infiltrated a major U.S. services firm by exploiting an SQL-related vulnerability. They deployed a custom Go-based remote access trojan (RAT) named Backdoor.Turn, which concealed command-and-control (C2) traffic within Microsoft Teams' TURN relay infrastructure. This method allowed the attackers to remain undetected for one to two months, as the malicious traffic appeared as legitimate Teams communication. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/06/16/dragonforce-microsoft-teams-malware-backdoor-turn/?utm_source=openai)) This incident underscores a significant evolution in cyberattack methodologies, highlighting the increasing sophistication of threat actors in leveraging trusted communication platforms to evade detection. Organizations must reassess their security postures to address such advanced persistent threats.
3 months ago
Kill Chain
Microsoft Uncovers Sophisticated Windows Clipper Malware Campaign
In June 2026, Microsoft disclosed a sophisticated malware campaign targeting Windows users through USB drives containing malicious LNK files. Once executed, these shortcuts leveraged Windows Script Host and ActiveX to initiate a Tor proxy, establishing a connection to a hidden command-and-control (C2) server. The primary objective of this campaign was to deploy a cryptocurrency clipper, designed to intercept and alter clipboard contents, thereby redirecting cryptocurrency transactions to attacker-controlled wallets. This incident underscores the persistent threat posed by USB-based malware and the evolving tactics of cybercriminals who exploit legitimate Windows functionalities to evade detection. The use of Tor for C2 communication highlights the increasing adoption of anonymization techniques by threat actors, complicating traditional network defense strategies.
3 months ago
Kill Chain
Red Hat npm Supply Chain Attack: A Wake-Up Call for Software Security
In June 2026, Red Hat's npm packages were compromised in a significant supply chain attack. Threat actors infiltrated the @redhat-cloud-services namespace, injecting a credential-stealing worm into 32 packages, affecting 96 versions. These malicious packages, downloaded over 116,000 times weekly, exploited GitHub Actions' OpenID Connect to publish the compromised code, indicating a breach in the CI/CD pipeline. The attack led to unauthorized access to sensitive credentials, posing substantial risks to downstream users. ([aikido.dev](https://www.aikido.dev/blog/red-hat-npm-packages-compromised-credential-stealing-worm?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting trusted software ecosystems. Organizations must enhance their security measures, particularly in CI/CD pipelines, to prevent similar breaches. The event highlights the necessity for continuous monitoring and rapid response strategies to mitigate the impact of such sophisticated attacks.
3 months ago
Kill Chain
Mastra npm Supply Chain Attack: A 2026 Case Study
In June 2026, a significant supply chain attack targeted the Mastra npm ecosystem, compromising over 140 packages. The attack originated from the hijacking of the 'ehindero' npm maintainer account, which was used to publish malicious versions of Mastra packages. These versions introduced 'easy-day-js,' a typosquat of the popular 'dayjs' library. Upon installation, 'easy-day-js' executed a postinstall script that disabled TLS certificate verification, contacted attacker-controlled command-and-control infrastructure, downloaded a second-stage payload, and executed it as a hidden process. This sophisticated attack posed substantial risks to developers and organizations relying on the affected packages. This incident underscores the escalating threat of supply chain attacks within the open-source ecosystem. The attackers' use of typosquatting and account hijacking highlights the need for enhanced security measures in package management and distribution. Organizations must remain vigilant, regularly audit their dependencies, and implement robust security practices to mitigate such risks.
3 months ago
Kill Chain
FreeBSD CVE-2026-3038: Understanding the Critical Kernel Vulnerability
In March 2026, a critical vulnerability identified as CVE-2026-3038 was discovered in the FreeBSD kernel's rtsock_msg_buffer() function. This flaw allows unprivileged users to trigger a stack buffer overflow by crafting malicious routing socket requests, leading to immediate kernel panics due to stack canary corruption. The vulnerability affects FreeBSD versions 13.5, 14.3, and 15.0 prior to specific patches. ([cve.org](https://www.cve.org/CVERecord?id=CVE-2026-3038&utm_source=openai)) The discovery of CVE-2026-3038 underscores the ongoing challenges in securing kernel-level code, highlighting the need for rigorous validation of user-supplied data. This incident serves as a reminder of the importance of timely patching and continuous monitoring to mitigate potential exploits that could lead to system crashes or privilege escalation.
3 months ago
Kill Chain
Malware Developers Use Forbidden Text to Thwart AI Analysis
In June 2026, security researchers identified a novel technique where malware developers embed forbidden text related to nuclear and biological weapons within spyware code. This method aims to disrupt AI-based analysis tools by causing them to refuse processing or misclassify the malware, thereby evading detection. The malicious code is concealed within large JavaScript comments containing sensitive keywords, followed by obfuscated payloads executed at runtime. This approach targets AI systems that lack robust content isolation, leading to analysis failures and potential security breaches. This incident underscores the evolving tactics of cyber adversaries who exploit AI vulnerabilities to bypass detection mechanisms. The use of forbidden text to manipulate AI analysis highlights the need for enhanced security measures in AI-driven systems, emphasizing the importance of developing resilient AI models capable of handling adversarial inputs without compromising performance.
3 months ago
Kill Chain
Kodak Data Breach 2026: ShinyHunters Extortion Group Claims Responsibility
In June 2026, Kodak confirmed a data breach after the ShinyHunters extortion group claimed responsibility for accessing over 2.2 million records containing customer personally identifiable information (PII) and internal corporate data. The attackers threatened to leak the exfiltrated data if their demands were not met by June 18, 2026. Kodak engaged external cybersecurity experts and law enforcement to investigate the incident and mitigate potential threats to their systems and operations. This incident underscores the escalating threat posed by cyber extortion groups like ShinyHunters, who have been linked to multiple high-profile data breaches in 2026, including attacks on Oracle PeopleSoft servers and various universities. Organizations must enhance their cybersecurity measures to protect sensitive data and prevent similar breaches.
3 months ago
Kill Chain
Crypto Clipper Campaign: A New Era of Cyber Deception
In June 2026, a sophisticated cyber campaign was uncovered wherein an unidentified threat actor utilized multiple platforms to distribute a Rust-based cryptocurrency clipboard hijacker targeting Windows and macOS users. The malware was disseminated through a dedicated WordPress phishing page, GitHub and SourceForge projects promoted by fake accounts, and a YouTube channel featuring AI-generated narrators. Additionally, the actor manipulated reputation systems by posting benign votes and "safe" comments on VirusTotal to misclassify the malicious files as harmless. This campaign highlights the evolving tactics of cybercriminals who exploit trust mechanisms across various platforms to deceive users into downloading malicious software. The use of AI-generated content and coordinated fake reviews underscores the need for heightened vigilance and advanced detection methods to combat such deceptive practices.
3 months ago
Kill Chain
Debate Erupts Over U.S. Ban on Anthropic's AI Models
In June 2026, the U.S. government issued an export control order restricting foreign nationals from accessing Anthropic's advanced AI models, Claude Fable 5 and Mythos 5, citing national security concerns. This led Anthropic to suspend the models' use for all customers to ensure compliance. The security community criticized the decision, arguing that it hampers defenders' access to crucial tools while doing little to prevent adversaries from developing similar capabilities. Experts highlighted that such restrictions might inadvertently accelerate the development of decentralized, open-source alternatives, potentially diminishing U.S. leadership in AI security. The incident underscores the delicate balance between national security and technological advancement, emphasizing the need for policies that support innovation while mitigating risks.
3 months ago
Kill Chain
Phantom Stealer: The Rise of Fileless Malware Targeting Financial Institutions
In June 2026, a sophisticated phishing campaign targeted banks and high-value organizations, deploying Phantom Stealer—a fileless malware designed to evade traditional endpoint defenses. The attack began with phishing emails containing seemingly legitimate business documents. Upon opening, a heavily obfuscated batch file initiated a multistage infection chain, injecting Phantom Stealer into the Windows Explorer process. Operating entirely in memory, the malware silently exfiltrated browser credentials, session cookies, and financial data through multiple channels, including Telegram, Discord, FTP, and SMTP. This incident underscores the evolving tactics of cybercriminals, highlighting the increasing use of fileless malware and advanced evasion techniques. Organizations must enhance their security posture by adopting behavior-based detection systems and educating employees on recognizing sophisticated phishing attempts to mitigate such threats.
3 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports