Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Computer Software/Engineering

Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.

2541 threat reports
Page 65 of 212
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Computer Software/Engineering Threat Reports

Showing 769–780 / 2541 reports
Hermes AI Agent's Role in Thai Finance Ministry Cyberattack
Government Administration3 months ago

Hermes AI Agent's Role in Thai Finance Ministry Cyberattack

In July 2026, threat intelligence firm Hunt.io and security researcher Bob Diachenko uncovered a cyberattack targeting Thailand's Ministry of Finance. The attackers utilized the open-source Hermes AI agent in its unattended 'YOLO' mode to automate post-exploitation activities. Evidence from exposed web directories indicated that multiple systems within the ministry's network were compromised. The attack involved deploying web shells, exploiting internal services such as Hadoop and Apache Ambari, and attempting to access personnel records dating back to 2012. Despite these findings, the Ministry of Finance has not confirmed the breach. This incident underscores the escalating use of autonomous AI agents in cyberattacks, highlighting the need for enhanced security measures against AI-driven threats. The ability of AI agents to operate independently and execute complex attack sequences poses significant challenges for traditional cybersecurity defenses.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(low)
Read report
BlueNoroff's 2026 Zoom Phishing Campaign: A Wake-Up Call for Crypto Firms
Financial Services3 months ago

BlueNoroff's 2026 Zoom Phishing Campaign: A Wake-Up Call for Crypto Firms

In July 2026, the North Korean state-sponsored group BlueNoroff launched a sophisticated phishing campaign targeting cryptocurrency organizations. The attackers utilized typosquatted Zoom and Microsoft Teams domains to impersonate legitimate videoconferencing platforms. By hijacking trusted Telegram accounts, they invited high-ranking employees to fake meetings, where victims were prompted to grant webcam access. This access allowed the attackers to profile victims' cryptocurrency wallets before delivering malware, enabling selective targeting of high-value individuals. This incident underscores the evolving tactics of threat actors who exploit trust in widely used communication platforms. The integration of social engineering with advanced reconnaissance techniques highlights the need for heightened vigilance and robust security measures within the cryptocurrency sector.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
HollowGraph Malware: Exploiting Microsoft 365 Calendars for Stealthy Cyber-Espionage
Computer Software/Engineering3 months ago

HollowGraph Malware: Exploiting Microsoft 365 Calendars for Stealthy Cyber-Espionage

In July 2026, cybersecurity researchers uncovered HollowGraph, a sophisticated malware that exploits Microsoft 365 calendar events for covert command-and-control (C2) communication and data exfiltration. By embedding encrypted instructions and stolen data within calendar events dated far into the future (e.g., May 13, 2050), HollowGraph effectively evades detection by blending malicious activities with legitimate Microsoft Graph API traffic. This technique has been observed targeting at least 12 Israeli organizations, with active communications detected between June and July 2026. The malware's design allows it to bypass traditional security measures, posing significant risks to organizations relying on Microsoft 365 services. The emergence of HollowGraph underscores a growing trend where threat actors leverage trusted cloud services to conduct stealthy cyber-espionage campaigns. This incident highlights the critical need for organizations to enhance monitoring of cloud-based activities, implement robust identity and access management controls, and stay vigilant against novel attack vectors that exploit legitimate platforms for malicious purposes.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
UAC-0099's Innovative Use of Notepad++ Plugins in Malware Deployment
Computer Software/Engineering3 months ago

UAC-0099's Innovative Use of Notepad++ Plugins in Malware Deployment

In July 2026, the Russia-aligned threat group UAC-0099 initiated a sophisticated phishing campaign targeting Ukrainian organizations. The attack began with emails containing image attachments that, when clicked, redirected victims to download a ZIP archive. This archive included a VBScript disguised as a PDF, which, upon execution, installed a legitimate version of Notepad++ alongside a malicious plugin named LUNCHPOKE. This plugin facilitated the deployment of additional malware components, including BURNYBEAR and MATCHBOIL.V2, establishing persistence and enabling further malicious activities on the compromised systems. This incident underscores the evolving tactics of threat actors who exploit trusted software to deliver malware, bypassing traditional security measures. The use of legitimate applications like Notepad++ as delivery mechanisms highlights the need for heightened vigilance and advanced detection capabilities to identify and mitigate such sophisticated threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(low)
Read report
NodeBB Urges Immediate Update Following Discovery of Critical Vulnerabilities
Information Technology/IT3 months ago

NodeBB Urges Immediate Update Following Discovery of Critical Vulnerabilities

In July 2026, Aikido Security's AI-driven penetration testing agents identified eight high-severity vulnerabilities in NodeBB, an open-source forum software. These flaws, present in all versions prior to 4.14.0, allowed unauthorized access to administrative dashboards, exposure of private messages, and execution of arbitrary code through cross-site scripting. NodeBB addressed these issues in version 4.14.2, urging administrators to update promptly to mitigate potential exploits. This incident underscores the growing role of AI in both identifying and potentially exploiting software vulnerabilities. Organizations must remain vigilant, ensuring timely updates and adopting proactive security measures to defend against increasingly sophisticated threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Command Injection Vulnerability in Microsoft Bing Images (CVE-2026-32194)
Internet3 months ago

Critical Command Injection Vulnerability in Microsoft Bing Images (CVE-2026-32194)

In March 2026, a critical command injection vulnerability (CVE-2026-32194) was discovered in Microsoft Bing Images, allowing unauthorized attackers to execute arbitrary code over a network. This flaw stemmed from improper neutralization of special elements used in commands, enabling remote code execution with high privileges. Microsoft promptly addressed the issue by releasing a security update to mitigate the risk. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-32194?utm_source=openai)) This incident underscores the persistent threat of command injection vulnerabilities in web services, highlighting the necessity for continuous security assessments and prompt patch management to protect against potential exploits.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
ChatGPT's 'AgentForger' Vulnerability: A Wake-Up Call for AI Security
Computer Software/Engineering3 months ago

ChatGPT's 'AgentForger' Vulnerability: A Wake-Up Call for AI Security

In June 2026, Zenity Labs identified a critical vulnerability in OpenAI's ChatGPT Workspace Agents, termed 'AgentForger.' This flaw allowed attackers to craft a phishing link that, when clicked by an employee, could silently create and deploy an autonomous AI agent within the organization's ChatGPT environment. This rogue agent would inherit the employee's identity and access privileges, operating without the employee's knowledge or consent. OpenAI addressed and patched this vulnerability by June 8, 2026. ([zenity.io](https://zenity.io/company-overview/newsroom/company-news/zenity-labs-uncovers-agentforger-a-chatgpt-vulnerability?utm_source=openai)) The 'AgentForger' incident underscores the evolving nature of cyber threats targeting AI systems. As organizations increasingly integrate AI agents into their workflows, ensuring robust security measures and prompt vulnerability management becomes paramount to prevent unauthorized access and potential data breaches.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Hackers Exploit Notepad++ Plugins to Install Malware - July 2026
Government Administration3 months ago

Hackers Exploit Notepad++ Plugins to Install Malware - July 2026

In July 2026, Ukraine's CERT-UA identified a cyberattack campaign by the threat group UAC-0099, which distributed a ZIP archive containing the legitimate Notepad++ application alongside a malicious plugin named LunchPoke. This plugin established persistence on infected systems. The attackers employed a VBS script disguised as a PDF to initiate the infection chain, leading to the installation of additional malware components, including BurnyBear and MatchBoil V2 loaders. The campaign primarily targeted organizations in Ukraine and is linked to the APT44 group, also known as Sandworm. This incident underscores the evolving tactics of threat actors who exploit trusted software to deliver malware, highlighting the need for organizations to scrutinize software sources and implement robust security measures to detect and prevent such sophisticated attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(low)
Read report
Fake Claude App via Bing Ads Delivers SectopRAT Malware
Computer Software/Engineering3 months ago

Fake Claude App via Bing Ads Delivers SectopRAT Malware

In July 2026, a sophisticated malvertising campaign named 'FakeAgent' exploited Bing advertisements to distribute the SectopRAT malware. Attackers created a fake Claude desktop application installer, hosted on a legitimate Claude.ai domain, which was promoted through Bing ads. Unsuspecting users searching for the Claude desktop app were redirected to this malicious installer, leading to the compromise of at least 29 organizations over a two-day period. The malware, SectopRAT, is a remote access trojan with information-stealing capabilities, allowing attackers to exfiltrate sensitive data and maintain persistent access to infected systems. This incident underscores the evolving tactics of cybercriminals who leverage legitimate platforms and advertising services to disseminate malware. The use of authentic domains and sophisticated social engineering techniques highlights the need for heightened vigilance among users and organizations. It also emphasizes the importance of downloading software exclusively from official and verified sources to mitigate the risk of such deceptive attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Emerging Cyber Threats: Android Spyware, PLC Attacks, and AI Image Prompt Injections
Computer Software/Engineering3 months ago

Emerging Cyber Threats: Android Spyware, PLC Attacks, and AI Image Prompt Injections

In July 2026, a series of sophisticated cyber threats emerged, including Android spyware, PLC attacks, and AI image prompt injections. These incidents involved malicious packages stealing data, counterfeit extensions enabling remote access, and images embedding hidden commands to manipulate AI agents. Such attacks exploited vulnerabilities in open systems, weak code, and standard network traffic, posing significant risks to both individual users and organizations. The current relevance of these incidents lies in the evolving nature of cyber threats, where attackers increasingly leverage advanced techniques to infiltrate systems. The rise in AI-driven attacks and the exploitation of everyday applications underscore the need for heightened vigilance and robust security measures to protect against such multifaceted threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Dolphin X Malware: AI-Powered Threat Targeting High-Value Victims
Financial Services3 months ago

Dolphin X Malware: AI-Powered Threat Targeting High-Value Victims

In July 2026, cybersecurity researchers identified 'Dolphin X,' a sophisticated Windows-based remote access trojan (RAT) and infostealer. This malware targets over 300 applications, including browsers, cryptocurrency wallets, password managers, and cloud command-line tools. Notably, Dolphin X incorporates an AI-powered profiling system that analyzes infected systems' application usage, browsing history, and installed software to assign risk scores. These scores enable attackers to prioritize high-value targets, such as developers with access to sensitive cloud production environments. The malware is marketed on cybercrime forums under a malware-as-a-service model, with subscription tiers offering varying levels of obfuscation and feature sets. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-dolphin-x-malware-uses-ai-to-rank-high-value-targets/?utm_source=openai)) The emergence of Dolphin X underscores a concerning trend: the integration of artificial intelligence into cybercriminal tools to enhance operational efficiency and target selection. This development highlights the need for organizations to bolster their cybersecurity defenses, particularly in protecting developer workstations and sensitive credentials, to mitigate the risks posed by such advanced threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
SANDWORM_MODE: Unveiling the npm Supply Chain Attack on AI Development Tools
Computer Software/Engineering3 months ago

SANDWORM_MODE: Unveiling the npm Supply Chain Attack on AI Development Tools

In February 2026, the SANDWORM_MODE malware campaign targeted the npm ecosystem by distributing 19 typosquatted packages under aliases 'official334' and 'javaorg'. Upon installation, these packages executed a multi-stage attack: initially harvesting developer credentials and environment variables, followed by deploying a malicious MCP server to compromise AI coding assistants. The malware propagated by injecting itself into GitHub repositories and CI/CD pipelines, exfiltrating sensitive data, and, if thwarted, activating a destructive fallback to erase user files. ([crowdstrike.com](https://www.crowdstrike.com/en-us/blog/denying-the-worm-sandworm-mode-and-ai-toolchain-supply-chain-attacks/?utm_source=openai)) This incident underscores the escalating sophistication of supply chain attacks, particularly those exploiting AI development tools. Organizations must enhance their security measures to detect and prevent such multi-faceted threats that blend into legitimate development workflows.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports